Week of May 4, 2026: Palo Alto firewall zero-day, DigiCert breach, cPanel mass exploitation

Security leaders tracked CISA's new CI Fortify resilience guidance, Palo Alto Networks' disclosure of likely nation-state exploitation of a PAN-OS firewall zero-day, and a DigiCert breach that let an attacker issue rogue EV code-signing certificates. The week also brought mass exploitation of a critical cPanel flaw, a patched MOVEit Automation authentication bypass, and a Microsoft-detailed phishing campaign that hijacked employee accounts through fake compliance notices.

CISA launches CI Fortify guidance for critical infrastructure resilience

CISA released guidance called CI Fortify to help critical infrastructure organizations keep delivering essential services while operating under cyberattack. The guidance urged operators across all sectors to invest in isolation and recovery capabilities ahead of an incident, including cutting ties to third-party vendors and telecommunications providers when needed and practicing manual operations. CISA Acting Director Nick Andersen said the guidance helps organizations defend against actors seeking to degrade or disrupt infrastructure. The initiative asked critical infrastructure entities to test recovery plans before a crisis occurs, not during one. (CISA)

Palo Alto says nation-state actors likely behind PAN-OS firewall zero-day

Palo Alto Networks confirmed that unauthenticated attackers exploited CVE-2026-0300, a buffer overflow in the PAN-OS User-ID Authentication Portal, to gain root-level remote code execution on PA-Series and VM-Series firewalls. Unit 42 traced a multi-stage intrusion beginning April 9 that included shellcode injection, log tampering, Active Directory reconnaissance, and deployment of EarthWorm and ReverseSocks5 tunneling tools, with a known association to prior China-nexus intrusion activity. Palo Alto Networks said the campaign was likely the work of state-sponsored threat actors and urged customers to restrict portal access while patches remain in development. (Help Net Security)

DigiCert discloses breach that enabled rogue EV code-signing certificates

DigiCert disclosed that a social engineering attack against its customer-support channel let a threat actor compromise internal systems and generate unauthorized EV Code Signing certificates. The attacker delivered a malicious screensaver file disguised as a screenshot, then used a support-portal viewing feature to access initialization codes for approved but undelivered orders. DigiCert revoked 60 code signing certificates, including 27 tied to the attacker's activity, and said a second compromised system went undetected for almost two weeks before a security researcher flagged certificate misuse linked to the Zhong Stealer malware family. (Help Net Security)

Mass exploitation of critical cPanel flaw spreads ransomware and malware

A critical cPanel authentication bypass, CVE-2026-41940, moved from exploratory probing into mass exploitation, with attackers deploying a Go-based ransomware encryptor that appends a .sorry extension to files and a separate Mirai botnet variant named nuclear.x86. Internet scanner Censys identified 8,859 hosts exposing directories with encrypted filenames, and Shadowserver Foundation detected over 44,000 unique cPanel-related IPs scanning or attacking its honeypot sensors. A separate campaign tracked by Ctrl-Alt-Intel used the same flaw for espionage against government and military targets in South-East Asia. cPanel released updated patches and a revised detection script after the original produced false positives. (Help Net Security)

Progress Software patches critical MOVEit Automation authentication bypass

Progress Software patched two vulnerabilities in MOVEit Automation: CVE-2026-4670, a critical authentication bypass exploitable by unauthenticated attackers, and CVE-2026-5174, a privilege escalation flaw. The pair affected MOVEit Automation versions 2025.1.4 and earlier, 2025.0.8 and earlier, and 2024.1.7 and earlier, and combined could let a remote attacker gain administrative control, access stored credentials, and reach sensitive business data. Airbus researchers reported the flaws privately, and no exploitation in the wild was reported. Progress fixed the issues in versions 2025.1.5, 2025.0.9, and 2024.1.8, requiring a full installer upgrade. (Help Net Security)

Microsoft details AiTM phishing campaign using fake compliance notices

Microsoft's Defender Research team detailed a phishing campaign that ran between April 14 and 16, 2026, impersonating internal HR and compliance notices to compromise Microsoft 365 accounts. The campaign targeted more than 35,000 users across 13,000 organizations in 26 countries, concentrating on the United States, and used a multi-stage redirect chain with CAPTCHA pages before presenting a fake Microsoft sign-in prompt. An adversary-in-the-middle session let attackers intercept authentication tokens, giving account access without needing victims' passwords or second factors. Microsoft recommended phishing-resistant multi-factor authentication such as FIDO security keys to blunt the technique. (Help Net Security)