A critical VPN security breach in Palo Alto Networks products is actively being exploited by ransomware groups to bypass authentication and access internal networks without passwords. Small business owners using these VPN solutions must patch immediately, and should also address emerging threats from preinstalled device malware and compromised third-party applications.
Today's cybersecurity update for small business owners covers critical threats requiring immediate action:
RANSOMWARE GROUPS EXPLOITING PALO ALTO VPN FLAW: Multiple ransomware groups including Qilin and Settra are actively exploiting CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access. The flaw allows attackers to create unauthorized VPN sessions without passwords, providing direct access to internal networks. Businesses using these VPN products must update immediately. (Source: Cybersecurity News)
PREINSTALLED ANDROID MALWARE DISCOVERED: Bitdefender researchers have identified "Midnight Mimosa," malware preinstalled on low-cost Android phones using MediaTek platforms. The malware is embedded in device firmware and cannot be uninstalled. It performs ad fraud, installs unauthorized applications, and builds proxy botnets. The campaign has been detected in 150 countries. Small businesses should avoid using budget Android devices for work purposes and stick with trusted manufacturers. (Source: Security Affairs)
DISCORD BOT BREACH EXPOSES 28 MILLION ACCOUNTS: The Double Counter moderation bot, used by over 600,000 gaming communities, has leaked data from approximately 28 million Discord accounts, including email addresses and IP addresses. This incident highlights the security risks posed by third-party applications and integrations. Businesses using collaboration platforms should audit all third-party apps and bots for security vulnerabilities. (Source: Tech Insider)
CISA ADDS FIVE VULNERABILITIES TO EXPLOITED FLAWS LIST: The U.S. Cybersecurity and Infrastructure Security Agency has added vulnerabilities in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND to its Known Exploited Vulnerabilities catalog. This designation indicates active exploitation by attackers. Organizations using these products should apply security updates immediately.
AI-ASSISTED RANSOMWARE ATTACKS SURGE: A Zscaler report reveals that AI-enhanced ransomware attacks have resulted in the theft of nearly 900 terabytes of data and $328 million in extortion payments. Attackers are increasingly targeting executives and leveraging trusted business applications for lateral movement within networks. Small businesses should implement strong multi-factor authentication, access controls, and monitoring for unusual activity on executive accounts. (Source: Cybersecurity Insiders)
AT&T SETTLES DATA BREACH LAWSUITS FOR $177 MILLION: AT&T has agreed to pay $177 million to settle litigation stemming from two major data breaches disclosed in 2024 that exposed customer personal information. This settlement demonstrates the significant financial consequences of inadequate data security measures. Small businesses face similar risks of lawsuits, regulatory fines, and reputational damage from data breaches. (Source: Cybersecurity News)
What VPN security breach risks should your business address today?
Ransomware groups including Qilin and Settra are exploiting CVE-2026-0257, an authentication bypass flaw in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access. This vulnerability lets attackers create unauthorized VPN sessions without credentials, giving them direct access to internal networks. Businesses using these products need to update immediately. Beyond VPN vulnerabilities, Android malware called Midnight Mimosa has been preinstalled on low-cost phones in 150 countries, and the Double Counter Discord bot breach exposed 28 million accounts. CISA has added five more vulnerable products (ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, ISC BIND) to its Known Exploited Vulnerabilities catalog. For SMBs, the immediate action is to verify your VPN platform and patch, audit third-party apps and integrations, and review access controls on executive accounts.
Key takeaways
- CVE-2026-0257 in Palo Alto VPN products allows unauthorized network access without passwords; update immediately if you use GlobalProtect or Prisma Access.
- Preinstalled malware on budget Android devices cannot be removed; professional staff should use phones from established manufacturers.
- Third-party collaboration tools and bots introduce breach risk; audit all integrations for security updates and permissions.
Frequently asked questions
Which Palo Alto products are affected by the VPN security breach?
PAN-OS GlobalProtect and Prisma Access are vulnerable to CVE-2026-0257, which allows attackers to bypass authentication and create VPN sessions without passwords. Check your systems immediately and apply patches from Palo Alto Networks.
How does the Midnight Mimosa Android malware affect my business?
This malware is preinstalled on low-cost Android phones using MediaTek platforms and cannot be uninstalled. It commits ad fraud and builds botnets. For business use, purchase phones from established manufacturers and avoid budget devices in employee hands.
What should I do about third-party apps like the Discord bot breach?
Audit all third-party integrations (bots, plugins, extensions) on your collaboration platforms. Verify they have security updates available, check what data they access, and disable any that are no longer actively maintained or pose unnecessary risk.
Why did AT&T pay $177 million and what does that mean for my business?
AT&T's settlement reflects the cost of data breach lawsuits, regulatory fines, and reputational damage from inadequate security. Small businesses face identical liability when customer data is exposed. Secure your networks, monitor for breaches, and have incident response plans in place.
Sources
- https://cybersecuritynews.com/palo-alto-globalprotect-flaw-vpn-access/
- https://securityaffairs.com/200759/malware/bitdefender-finds-preinstalled-android-malware-you-cant-uninstall-seen-in-150-countries.html
- https://tech-insider.org/double-counter-discord-bot-breach-28-million-accounts-2026
- https://securityaffairs.com/200734/security/u-s-cisa-adds-proftpd-onlyoffice-docs-strapi-apache-struts-and-isc-bind-flaws-to-its-known-exploited-vulnerabilities-catalog.html
- https://www.cybersecurity-insiders.com/zscaler-report-finds-ai-assisted-ransomware-attacks-drive-massive-data-theft-and-328-million-in-extortion-payments
- https://cybersecuritynews.com/att-to-pay-177-million
Keep reading
Produced with AI from TC3's daily cyber briefing video. Not individually reviewed before publishing; questions go to a human at [email protected].