June 1, 2026 by sig9

Hacker Wars - June 01, 2026

Your daily dose of infosec chaos

It’s a triple threat Monday: VPN authentication bypasses, Linux kernel privilege escalation, and WordPress plugin takeovers. If your patching backlog was already giving you anxiety, this isn’t going to help. Grab a coffee and check your attack surface.

Palo Alto GlobalProtect VPN Auth Bypass Under Active Exploitation

Palo Alto Networks confirmed that CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect, is now being actively exploited to breach corporate networks. Attackers are leveraging the flaw to bypass VPN authentication entirely, essentially walking through the front door without a key. If your org relies on Palo Alto for remote access, this is a five-alarm fire.

What to do: Patch PAN-OS immediately. If you can’t patch yet, restrict GlobalProtect portal access to trusted IPs and enable MFA as a temporary band-aid.

CIFSwitch Linux Kernel Flaw Grants Root on Multiple Distros

A new local privilege escalation vulnerability dubbed CIFSwitch lets attackers forge CIFS authentication key descriptions and abuse the Linux kernel’s key request mechanism to gain root. The flaw affects multiple distributions and is particularly nasty because it leverages a fundamental kernel subsystem. Local attackers can go from unprivileged user to full root with a single exploit.

What to do: Monitor for kernel patches from your distro vendor. Restrict CIFS module loading if possible and audit who has local access to your Linux boxes.

WP Maps Pro Plugin Bug Lets Attackers Create Admin Accounts

Hackers are actively exploiting a vulnerability in the WP Maps Pro WordPress plugin to create rogue administrator accounts on affected sites - no authentication required. The unauthenticated admin creation flaw means any attacker can waltz in and take full control of vulnerable WordPress installations. If you’re running WP Maps Pro, assume compromise until proven otherwise.

What to do: Update WP Maps Pro to the latest version immediately. Check your WordPress user list for suspicious admin accounts and audit your site for backdoors.

That’s all for now. Patch your stuff and don’t click suspicious links.

Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown

This bulletin is provided for informational purposes. Contact us for tailored security analysis.