Hackers take advantage of recently fixed vulnerability in Palo Alto firewall.

Threat actors are taking advantage of a recently patched vulnerability in Palo Alto Networks’ PAN-OS firewall software. The flaw, officially known as CVE-2025-0108, is an authentication bypass vulnerability that can allow unauthorized attackers with network access to the management web interface to bypass the authentication required by the management web interface and execute certain PHP scripts. Although Palo Alto Networks has already addressed this vulnerability with a patch, a proof-of-concept exploit is available to the public. The company has reported instances of exploit attempts using this exploit in combination with another vulnerability, CVE-2024-9474, on unpatched and unsecured PAN-OS web management interfaces.

In a separate development, Proofpoint researchers have identified a new strain of macOS malware called “FrigidStealer” being distributed through web inject campaigns. This malicious software is designed to steal sensitive information such as passwords, browser cookies, and cryptocurrency-related files. The attack chain typically features malicious injects in the form of JavaScript scripts served to website visitors, a traffic distribution service responsible for determining which payload each user receives, and an ultimate payload that is downloaded by the script. In the case of FrigidStealer, compromised websites prompt visitors to update their browsers. Clicking on the “Update now” button triggers the download of a DMG file by the threat actor’s TDS. By right-clicking and choosing to open the file, users bypass macOS’ Gatekeeper security feature, allowing the malware to be executed and installed silently.

Meanwhile, Lee Enterprises, a US newspaper publisher, is still dealing with the aftermath of a ransomware attack it experienced on February 3rd. In a filing with the SEC, the company disclosed that threat actors infiltrated its network, encrypted critical applications, and stole certain files. The attack disrupted the company’s operations, affecting the distribution of products, billing, collections, and vendor payments. Print publication distribution suffered delays, and online operations were partially hindered as a result of the attack.

In today’s news, events have impacted various industries and countries, including the United States. Stay tuned for further updates and developments on cybersecurity threats and vulnerabilities.