Good morning. Two items that change your week, both published in the last 24 hours.
SafePay gets the joint advisory treatment
The FBI, CISA, the US Secret Service, Germany's LKA Rheinland-Pfalz, and two UK agencies published joint advisory AA26-293A on SafePay ransomware: 600+ victims since August 2024. Initial access comes through stolen creds, brute force, phishing, and five exploited edge-device CVEs. From there the group lives off the land with PsExec, WinRM, and RClone, wipes backups, and encrypts.
What to do: patch every internet-facing firewall, VPN, and backup product, put MFA on all remote access, and hunt for new admin accounts and LOLBin use in business hours. The huntable IoC set (IPs, hashes, hostnames) is in the IoC Library.
Qilin and INC are exploiting GlobalProtect
Unit 42 confirms Qilin, INC, and Settra ransomware groups are actively exploiting the PAN-OS GlobalProtect authentication bypass, CVE-2026-0257. Their sessions look like legitimate VPN logins and can bypass MFA. Five months after the KEV listing, this flaw is now a reliable ransomware on-ramp.
What to do: patch now and explicitly terminate existing sessions. The fix does not kill them for you. Then hunt your GlobalProtect logs for the attacker IPs and host IDs Unit 42 published.
Also in KEV: five Plex flaws
CISA's KEV catalog also picked up five Plex Media Server flaws that chain into remote code execution. If Plex runs on anything near your network, patch it.
Full entries with huntable indicators: kevinthecyberguy.com/vuln-watch and kevinthecyberguy.com/ioc-library
Principal Cybersecurity Engineer with 17+ years across banking, payments, and consulting. Writing about AI security, identity, and the fundamentals that stop most incidents. kevintswaney.com