--- title: Critical Palo Alto VPN bug now exploited by Qilin... description: The Qilin ransomware gang is actively exploiting CVE-2026-0257, a critical authentication bypass vulnerability in Palo Alto Networks' PAN-OS GlobalProtect VPN,... canonical: https://daily.dev/posts/critical-palo-alto-vpn-bug-now-exploited-by-qilin-ransomware-gang-f3pmcolfl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Critical Palo Alto VPN bug now exploited by Qilin ransomware gang | daily.dev og:description: The Qilin ransomware gang is actively exploiting CVE-2026-0257, a critical authentication bypass vulnerability in Palo Alto Networks' PAN-OS GlobalProtect VPN,... og:url: https://daily.dev/posts/critical-palo-alto-vpn-bug-now-exploited-by-qilin-ransomware-gang-f3pmcolfl og:image: https://api.daily.dev/og/posts/f3pmcoLFl.png og:image:alt: Critical Palo Alto VPN bug now exploited by Qilin ransomware gang og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Critical Palo Alto VPN bug now exploited by Qilin ransomware gang **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary The Qilin ransomware gang is actively exploiting CVE-2026-0257, a critical authentication bypass vulnerability in Palo Alto Networks' PAN-OS GlobalProtect VPN, to breach corporate networks. Arctic Wolf investigated multiple intrusions in June 2026 resulting in domain-wide Qilin ransomware deployment, with post-exploitation ranging from rapid encryption to full double-extortion, suggesting multiple affiliates operating under the Qilin RaaS model. Palo Alto patched the flaw on May 13, CISA added it to its Known Exploited Vulnerabilities catalog on May 29, yet over 167,000–172,000 GlobalProtect instances remain exposed online. Qilin has claimed over 2,000 victims since 2022, including Nissan, Synnovis, and Lee Enterprises. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#ransomware](https://daily.dev/tags/ransomware), [#vpn](https://daily.dev/tags/vpn) [View this post on daily.dev](https://daily.dev/posts/critical-palo-alto-vpn-bug-now-exploited-by-qilin-ransomware-gang-f3pmcolfl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Critical Palo Alto VPN bug now exploited by Qilin ransomware gang","url":"https://daily.dev/posts/critical-palo-alto-vpn-bug-now-exploited-by-qilin-ransomware-gang-f3pmcolfl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/critical-palo-alto-vpn-bug-now-exploited-by-qilin-ransomware-gang-f3pmcolfl"},"datePublished":"2026-07-21T10:16:00.395Z","dateModified":"2026-07-24T10:55:22.359Z","description":"The Qilin ransomware gang is actively exploiting CVE-2026-0257, a critical authentication bypass vulnerability in Palo Alto Networks' PAN-OS GlobalProtect VPN,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/39a1a8480ab0d91ef0888ce5cb8b7539?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/39a1a8480ab0d91ef0888ce5cb8b7539?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/critical-palo-alto-vpn-bug-now-exploited-by-qilin-ransomware-gang-f3pmcolfl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ransomware,vpn","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Critical Palo Alto VPN bug now exploited by Qilin ransomware gang"}]} ```