Critical Palo Alto VPN bug now exploited by Qilin ransomware gang

Arctic Wolf reports that Qilin ransomware affiliates are actively exploiting a critical PAN-OS GlobalProtect authentication bypass (CVE-2026-0257) to establish unauthorized VPN access and deploy ransomware, with multiple incidents in June 2026 leading to domain-wide encryption; CISA has listed the flaw in its Known Exploited Vulnerability catalog, and internet scans show hundreds of thousands of exposed GlobalProtect instances, increasing the risk of further compromises.