Week of June 1, 2026

A command injection vulnerability in the PAN-OS management web interface, tracked as CVE-2025-0110, is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute commands with root privileges on the firewall. Initially rated medium severity, it was upgraded to critical after exploitation was observed.

A China-aligned cyber espionage campaign, Operation Dragon Weave, targeted government, research, academic, technology, and financial sectors in the Czech Republic and Taiwan. Attackers used spear-phishing emails with ZIP attachments to deliver an AdaptixC2 agent via a Rust loader and DLL side-loading. The malware uses Microsoft Azure Blob Storage for command-and-control, employing a dead drop approach to evade detection.

A phishing campaign uses fake purchase order emails with RAR attachments to deploy fileless PureLogs malware. The attack leverages process hollowing into MSBuild.exe to execute a downloader that retrieves the final payload in memory, stealing browser credentials, crypto wallets, and Discord tokens. FortiMail detected and blocked the emails.