The flaw has been in the exploited catalogue since May, and it is still how the ransomware crews are getting in
2026-10-12Security
ReliaQuest names Qilin and a newer operation called Settra as exploiting a GlobalProtect authentication bypass that Palo Alto disclosed in May. Nothing about the vulnerability is new. What is worth reading is that patching does not close the sessions a forged cookie already opened.