In today’s cybersecurity news…
Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks
The company is warning that “hackers are now exploiting a PAN-OS GlobalProtect authentication bypass flaw, in attacks attempting to breach corporate networks”. The CVE numbered flaw (CVE-2026-0257 ) was fixed earlier in May, however, on Friday, the advisory was updated to warn that “the flaw was now being actively exploited in attacks against unpatched devices, raising the severity rating to High.” As of Friday, it has also been added to the CISA KEV.
ChatGPT share links used to host fake outage pages to deliver malware
Cybercriminals are abusing ChatGPT’s sharing feature to distribute malware through a campaign researchers call “LLMShare.” Attackers create legitimate-looking ChatGPT share pages hosted on OpenAI’s domain and use them to display fake service outage messages. Victims are told they can continue using ChatGPT by downloading a supposed desktop application, which is actually malware. Researchers found that the campaign leveraged online advertising and users’ trust in recognizable AI brands to increase success rates. This is a different ChatGPT hacking story from the Grey Vibe story presented on Friday.
Federal audit reveals NIST’s NVD problems
A report released on Thursday from the Department of Commerce found that NIST, the National Institute of Standards and Technology, has “mismanaged a critical cybersecurity vulnerability database through poor planning, inefficient operations, duplicate federal programs, and failure to communicate with users.” The National Vulnerability Database also known as NVD, “collects information about computer security flaws and adds details like severity ratings and affected products.” In February 2024, the database’s enrichment contract lapsed, creating a backlog of unprocessed security flaws that has only grown worse. NIST leaders admitted they had “no long-term plan for clearing the backlog, even as it grew from about 13,000 unprocessed security flaws in June 2024 to over 27,000 by the end of 2025.”
(Cyberscoop and Inspector General’s report)
Google security engineer accused of profiting off confidential search trends on Polymarket
Google security engineer Michele Spagnuolo, a 36-year-old Italian citizen who lives in Switzerland, was arrested in New York, charged with crimes related to bets he allegedly placed on the decentralized prediction market platform that allows users to place bets on the outcomes of real-world events. He is accused of using confidential information pulled from Google systems, according to the Justice Department. He “allegedly abused internal access to Google’s non-public Year in Search data and placed a series of bets on the most searched people on Google in 2025.” The scam made him $1.2 million but now carries a possible maximum sentence of 50 years.
Huge thanks to our sponsor, Vanta
The good news: The Vanta [rhymes with Santa] Agent works like a GRC engineer in the background, finding every app your team uses, scoring the risk, and drafting fixes for you.
Vanta is the platform used by over sixteen thousand fast-moving companies like Ramp, Cursor, and Harvey who are shaping the future with AI, AND staying ahead of AI risk.
Get started at vanta.com/headlines.
North Korea’s Kimsuky deploys HTTPSpy in new attack
The state-sponsored threat actor also known as Velvet Chollima is being identified as responsible for a new wave of cyber attacks targeting South Korean military and corporate entities these past two months. It used social engineering tactics including spoofing security software installation pages and crafting a fake Webex meeting page that leveraged a legitimate meeting schedule,” said the white hat hacking group ENKI in an analysis published this week. Kimsuky has used these attacks to deliver a variant of “a known malware family dubbed HTTPSpy.”
Malicious npm packages published mimicking OpenSearch, Elasticsearch libraries
This appears to be the work of a lone wolf npm user, who on Thursday “published 14 malicious packages within a four-hour window.” According to Microsoft, these mimicked popular OpenSearch, Elasticsearch, DevOps, and environment-configuration libraries. The attacker used a newly created maintainer alias to target Amazon Web Services, HashiCorp Vault, GitHub Actions, and the npm registry itself. As pointed out in The Register, these types of attacks allow the actor to “move laterally across cloud environments, steal additional sensitive data, and push even more poisoned updates to packages owned by hijacked maintainer identities, thus expanding the attack beyond the initial 14.”
SoftBank to invest up to €75 billion to build French data centers
The company, which among other things, is both an investor in and customer of OpenAI, announced on Saturday that it plans to spend up to €75 billion (around $87 billion) to expand data center capacity in France to enable up to 5 gigawatts of additional data center capacity. The first phase involves building data centers in Dunkirk, Bosquel, and Bouchain all in northern France. This, they say, will be its largest AI infrastructure investment in Europe.
California AG sues 23andMe over 2023 breach
California Attorney General Rob Bonta filed the lawsuit against 23andMe, now Chrome Holding Co., over “the company’s failure to protect sensitive customer genetic and personal information.” This led to a high-profile data breach in 2023 that exposed the sensitive information of nearly 7 million customers, including more than 850,000 Californians. The California-based company “confirmed that the leaked data was genuine and claimed that it had been extracted following a credential-stuffing attack targeting accounts with weak credentials.” The incident exposed data genetic data, health predisposition information, ancestry and ethnicity information, biological relatives, and DNA matches.