Post links Palo Alto GlobalProtect VPN flaw to Qilin ransomware attacks
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Palo Alto Networks
- Product
- GlobalProtect VPN
- First seen
Summary
A Mastodon post links to a HackRead article that reports a Palo Alto Networks GlobalProtect VPN flaw is being exploited in ransomware attacks attributed to Qilin. The post does not name a CVE, and the exploitation claims are not independently confirmed in the item.
If you use Palo Alto Networks
Patch Palo Alto GlobalProtect to the vendor's fixed release now
Scan for indicators of compromise on systems exposed to the GlobalProtect VPN
Review VPN and authentication logs for unusual access
Restrict management interface exposure until patching is verified
Remove public access to PAN-OS management interfaces
Patch affected PAN-OS builds per Palo Alto's security advisory
What the sources say 2
· Mastodon: “Patch your Palo Alto Networks GlobalProtect VPN immediately and scan your environment for indicators of compromise before the second phase begins.” Source
· Mastodon: “Palo Alto's Oct. 29 update confirms PHP2Shell exploitation against internet-exposed PAN-OS management interfaces.” Source