Palo Alto Networks is warning that hackers are now exploiting a PAN-OS GlobalProtect authentication bypass flaw, tracked as CVE-2026-0257, in attacks attempting to breach corporate networks.
The company fixed the CVE-2026-0257 flaw earlier this month, warning that it could be used to establish unauthorized VPN connections on the device.
“GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection,” reads Palo Alto’s advisory.
The flaw received a Medium severity rating because it requires devices to be configured with authentication override cookies enabled and a specific certificate configuration.
Advertisement
However, on Friday, Palo Alto Networks updated the advisory to warn that the flaw was now being actively exploited in attacks against unpatched devices, raising the severity rating to High.
“Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied,” reads the update.
This update comes after Rapid7 warned that it had observed the flaw being exploited against numerous customers starting on May 17.
“Rapid7 MDR identified successful exploitation across numerous customers, however we did not observe any indication of successful lateral movement from the devices. The earliest date for observed exploitation was May 17, 2026,” explains Rapid7.
Advertisement
“As of May 29, 2026, this vulnerability has been added to the CISA KEV.”
According to Rapid7, the attacks began with hackers authenticating to GlobalProtect gateways using forged authentication override cookies that targeted the local administrator account.
The company first observed exploitation on May 18 from infrastructure hosted by Vultr, with a second wave of attacks detected on May 21 originating from Dromatics Systems.
In some cases, attackers were able to connect to the device via VPN using forged cookies, granting them access to internal networks. However, Rapid7 says that in many incidents, even though the appliance accepted the forged cookie, they were unable to establish a full VPN session.
Advertisement
Rapid7’s investigation into affected customers found that the impacted devices had GlobalProtect authentication override cookies enabled and were configured in a way that allowed attackers to forge valid authentication cookies.
The researchers say the flaw stems from PAN-OS’s validation of authentication override cookies.
A GlobalProtect VPN device decrypts these types of cookies using a configured private key and then trusts the decrypted contents without performing any signature verification.
If the same certificate is reused for both HTTPS services and authentication override cookies, attackers can obtain the corresponding public key via the HTTPS session and then use it to create forged cookies that the device will accept as legitimate.
Advertisement
Rapid7 developed a proof-of-concept exploit that demonstrates how an attacker can retrieve the public certificates exposed by a GlobalProtect portal or gateway, generate a forged authentication override cookie for an arbitrary user, and authenticate without knowing valid credentials. Using this PoC, the researchers successfully authenticated to an unpatched GlobalProtect gateway.
Organizations using GlobalProtect VPN devices should immediately install the latest security updates to patch the flaws.
Admins can also mitigate the flaw by turning off the authentication override feature or utilizing a different certificate for this feature and not sharing it with other services on the device.
CISA has now added the flaw to its Known Exploited Vulnerability catalog, ordering federal agencies to mitigate the flaw by June 1, 2026.
Advertisement
Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.
This guide covers the 6 surfaces you actually need to validate.
Plastic waste can now be converted directly into usable jet fuel
A tandem reactor system breaks plastic down at 460 degrees Celsius
Ruthenium catalyst sites delivered far better selectivity than commercial alternatives
Researchers at Nanjing Forestry University and Tsinghua University have demonstrated a new method for converting plastic waste directly into usable jet fuel, with estimated production costs ranging from $1.0 to $1.8 per kilogram.
The work comes as airlines, governments, and fuel producers continue searching for alternatives that could reduce dependence on conventional fossil-derived jet fuel.
While the technology remains under further development, the researchers say their approach combines favourable fuel characteristics with economics that appear competitive on paper.
Latest Videos From
New reactor design turns waste plastic into aviation fuel
The study, published inNature Energy, shows a tandem reactor system using hydro-pyrolysis and hydrogenolysis can convert plastic waste into jet-fuel-range hydrocarbons.
Advertisement
The researchers note plastic material first enters a reactor operating at 460 °C, where it is broken into smaller molecular compounds.
Those intermediate products then pass into a second stage operating at 160 °C, where a specially designed catalyst converts them into cycloalkane-rich aviation fuel suitable for further evaluation.
Professors Yadong Li and Dingsheng Wang explained that controlling the final product mix had long remained a challenge in plastic conversion research.
Advertisement
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
“The problem that kept pulling us back was selectivity,” they said, noting that conventional approaches often produce broad and difficult-to-control distributions of chemical products.
The team concentrated on atomically dispersed ruthenium, or Ru, sites supported on cobalt-aluminum oxide materials.
After evaluating multiple catalyst configurations, they found that isolated Ru sites delivered significantly different reaction behaviour compared with conventional alternatives.
Advertisement
They reported that the catalyst achieved hydrogenation performance more than 100 times greater than a commercial Ru/C catalyst during a key processing stage.
Economics and sustainability claims draw attention
The study arrives amid continuing efforts to expand sustainable aviation fuel production as airlines face pressure to lower emissions.
Advertisement
Aviation remains one of the more difficult sectors to decarbonize because aircraft require energy-dense liquid fuels that can operate under demanding flight conditions.
The group also reported successful catalyst preparation and testing at gram scale, while stating that both catalyst manufacturing and hydrogenation processes appear capable of scaling further.
The researchers said the resulting fuel demonstrated attractive performance characteristics while also offering potentially favourable economics.
“A techno-economic analysis put the competitive minimum selling price at $1.0–1.8 per kilogram,” Li and Wang said, describing the estimate as competitive.
Advertisement
For comparison, conventional fossil-based jet fuel currently costs roughly $1.00–$1.30 per kilogram, although prices change with global oil markets and refinery conditions.
Given the volatility tied to global oil markets, the conflict in Iran, and tensions across other oil-producing regions, a price-competitive alternative becomes increasingly difficult to ignore.
Future work will focus on kilogram-scale catalyst production and continuous feeding systems intended to improve operational efficiency.
Claude Guillemot, co-founder of French video game company Ubisoft, died Friday at the age of 69.
According to French media (via Bloomberg), Guillemot died in a plane crash in the French resort town of La Baule. He was one of two people aboard the plane, both of whom died.
Guillemot founded Ubisoft with his four brothers in 1986. Since then, the company has published the Assassin’s Creed, Far Cry, Prince of Persia, and Tom Clancy video game franchises, as well as many other titles. The family retains control of Ubisoft, and Guillemot’s brother Yves is still CEO.
Guillemot was also chairman of Guillemot Corp., which makes gaming and audio accessories.
Advertisement
“Ubisoft was deeply saddened to learn of the death of Claude Guillemot, co-founder of the group and chairman of Guillemot Corp., in an accident,” Ubisoft said in a statement. “Our thoughts are with his family and loved ones during this difficult time. No further statements will be made at this time.””
Prince also worked on Wolfenstein and Duke Nukem games.
id Software
Video game composer and sound designer Bobby Prince has died. An obituary states that Prince died on June 16 at the age of 81 following an illness. Developer id software shared the news of Prince’s passing.
Rest in peace to the video game music pioneer Bobby Prince. Your music lives on forever. pic.twitter.com/8LAT6CGZ5Y
Prince was perhaps best known for his pioneering work on the Doom series. The Library of Congress inducted his soundtrack for the original game into the National Recording Registry just last month.
Advertisement
“Despite the limitations of the 1993-era sound card drivers, Prince composed the perfect riff-shredding accompaniment for the game’s demon-slaying journey to hell and back,” the Library of Congress stated. “Taking advantage of his knowledge of MIDI, Prince even worked to ensure that the sound effects he created could cut through the music by assigning them to different MIDI frequencies.”
Prince also worked on games such as Wolfenstein 3D, Rise of the Triad and Duke Nukem 3D. In 2006, the Game Audio Network Guild honored Prince with a lifetime achievement award.
“Everyone at Romero Games is deeply saddened to learn of the passing of Bobby Prince,” Doom co-designer and id Software co-founder John Romero wrote on X. “He left an incredible mark on games and on my life.”
If you’ll excuse the pun, skillets seem to always be a hot topic.
More than in other sections of cookery, there is a continual quest to find the best one, or at least the best one you can afford. I’ve seen cycles of fetishization come and go for copper, cast-iron, and carbon steel.
At the Mall of New Hampshire in the 1980s, I remember watching a miraculous cooking-store demonstration of omelettes effortlessly sliding out of a Teflon pan. Then, only a few years ago, the industry pretty much dropped the whole Teflon category like a hot potato due to the pans’ propensity to give off harmful fumes if they get too hot. Less durable ceramic immediately filled the void, and we’re already realizing how quickly it can lose its nonstick magic.
All this time, stainless-steel pans have been waiting in the wings. They are durable, and lighter and less fussy than cast iron and carbon steel. They’re not nonstick, but that’s often fixed with a pat of butter. They sear well, and with a bit of TLC, they’re built for a lifetime of hard work.
Advertisement
All-Clad has been one of the great brands in stainless for years, but I wondered if other slightly more expensive skillets were worth a look, particularly as some are new to the market and others have been flying under the radar. Along with a 10-inch All-Clad, I called in similar-sized pans from Hestan, Viking, and Heritage Steel. Testing all these sounded like fun at first, but things got weird and stayed weird for a while, and only with a bunch of hands-on data gathering and time at the stove did I understand which pans I could recommend.
Pans Labyrinth
A smart and easy cheat for someone like me is to use All-Clad’s 10-inch D3 Fry Pan as a baseline. (“Fry pan” and “skillet” are used interchangeably in this category.) The D3 has been an America’s Test Kitchen and Wirecutter darling for years, with advocates seeking out traits like uniform heating across its surface, a comfortable handle, and cladding (layers of different metals). It’s $170 with a lid and $150 without, which is a good chunk of change, but it feels like a fair price for buy-it-for-life durability.
I own and love one of All-Clad’s 4-quart D5 Essential Pans, which is like a high-sided skillet, and it has a perfectly flat cooking surface. But the cooking surface on the D3 skillet All-Clad sent to me for this story was a bit domed–high in the center and low around the outside—not horribly so, but surprising to me, and among the dozen or so pans I called in, it was among the furthest out of whack. I also noticed that the rivets that hold the handle to the pan weren’t fully squished on there. It felt fine and didn’t wobble, but an All-Clad representative confirmed this wasn’t right. They sent another pan, and the rivets were as they should be on that one, but the bottom was pretty much the same. I learned that this amount of doming is within All-Clad’s tolerance range, but not within mine. What can I say? I like flat pans, I thought, looking wistfully at my perfect D5.
I had a similar level of trouble with another pan I had high hopes for. The new 10-inch Viking Pure Glide Pro, which I had seen at my favorite trade show, has a textured titanium layer for the cooking surface above an aluminum core and stainless-steel bottom layer. Impressively, this combination of materials created a capable nonstick competitor that I’d be a lot more excited about if it was part of a better, sturdier pan. The Viking had some temperature management issues that I’ll get to in a moment, and it either warped or arrived warped to the point that heating oil would form a moat around the center of the pan. If Viking fixes this, the Pure Glide Pro has the potential to be a hell of a pan, but it’s not there yet.
Recorded from the show floor at AXPONA 2026, this episode features Kendall Costello, Sales Operation Analyst at Loewe, and Amir Hejazi, Senior Engineer at Loewe. Topics covered include details about Loewe’s latest Stellar TVs and Leo headphone lineup, along with their return to the U.S. market. The conversation focuses on design priorities, key features, and how Loewe is positioning its products in a competitive premium market, with insight into how engineering and product strategy come together across both categories.
Sponsors: Thank you SVS for sponsoring this episode, along with Audeze for supplying all guests LCD-S20 Headphones, and Loewe and T10 Bespoke for sharing lounge space at AXPONA 2026.
This episode was recorded on April 12, 2026 (the third day of AXPONA 2026).
The BMPS Grand Finals have just concluded, and what an action-packed three days they were. We saw the rise of new titans like Divine Gaming, who, up until today, were the favorites to win the title. Sadly, veteran GodLike had other plans, who just had a stellar day in every single match. Another big surprise was the return of OG, who also qualified for the EWC in Paris by defeating SouL in the overall team standings. Here’s what the final BMPS rankings look like.
Apple’s wearable future is starting to come into focus, and cameras appear to be at its center. Bloomberg’s Mark Gurman reports that camera-equipped AirPods and Apple’s first smart glasses are currently on the roadmap for 2027. While they may look like ordinary accessories on the surface, both products could play a crucial role in helping Apple Intelligence understand the world around its users in real time.
Your AirPods might start paying attention
When most people think of AirPods, they think of music, podcasts, and phone calls. Cameras aren’t exactly high on the wishlist. But Apple has a different vision. The cameras wouldn’t be there for recording videos. Instead, they’d help gather information about the world around you and feed that data into Siri and Apple’s AI systems.
Nadeem Sarwar / Digital Trends
Imagine asking Siri about a building you’re looking at, identifying an object in front of you, or getting contextual information without ever pulling out your phone. So, your AirPods could become another set of eyes for Apple’s AI; that’s a dramatically different role from what earbuds do today.
Glasses to see, not just display
Then there’s Apple’s smart glasses, arguably one of the company’s most anticipated future products. Unlike the bulky Vision Pro headset, smart glasses could bring AI into a form factor people might actually wear all day. While details remain scarce, cameras are expected to play a crucial role, helping the device understand its surroundings and deliver real-time, useful information.
Amazon
What’s particularly interesting is how these products fit into Apple’s broader AI strategy. Most companies are trying to make AI more useful through apps and chatbots. Apple appears to be exploring something more ambient — AI that observes the world around you and responds when needed. Whether consumers are ready for camera-equipped wearables is another question entirely. But if Gurman’s report is accurate, 2027 could be remembered as the year Apple stopped thinking about AI as software and started turning it into something you wear.
It’s virtually impossible to live in modern society and not be tracked in some way. Websites track you, the apps you need and use every day could be the worst offenders in privacy invasion, and the devices you use it is tracking you, too. And even if you turn off the phone and go outside, you could being watched by the widespread Flock cameras that might be in your neighborhood. We know that tracking devices are all around every single one of us, all the time, every day. But sometimes you don’t even realize a device can track you in the first place.
Now, to walk things back a bit. We’re not out to terrify you into thinking your smart toaster is equivalent to the “1984” telescreen. Oftentimes, tracking is inevitable and even benign. Most electronic devices connected to the internet and receiving updates need basic usage telemetry to help the manufacturer fix bugs and optimize performance. With that in mind, these are five everyday tech devices that might be tracking your activity — for better or for worse.
Advertisement
Wi-Fi routers
Marius Karp/Shutterstock
In recent years, we’ve seen a scary news headline that says that Wi-Fi routers can be used like sonars to “see” inside buildings. Sadly, it’s no exaggeration. A Wi-Fi router can be utilized to map its surroundings. The technology is so sensitive it could theoretically track someone’s gait when walking, and possibly their breathing, even in another room.
What’s worse, a bad actor wouldn’t even have to compromise the network or buy a $10,000 frequency analyzer tool to do it; They’d only need a cheap smartphone kept in the network’s vicinity. Victims wouldn’t know when they were being tracked, either, and the more devices victims have, the more accurate the tracking gets. We already have concerns about mass surveillance with cameras, but now imagine the thousands upon thousands of Wi-Fi networks in every city and state retrofitted into a tracking apparatus that has x-ray vision — and imagine what dark forces out there would love to get their hands on said apparatus.
Now for a dose of reality. We’ve seen that this works, in theory, but so far we haven’t found documented cases where this has been abused. There are certainly concerning trends in that direction, like court cases arguing that that authorities should be able to track you with WiFi-based location, and consumer devices made by shady companies that boast Wi-Fi motion detection. On the flip side, a lot of the research around Wi-Fi sensing has been focused on potentially good use cases. We’d probably all be okay if grandma’s Wi-Fi network was leveraged to alert us in the event she takes a fall. For the possible unsavory uses of the tech, it may be possible to mitigate them by polluting the real data with false data.
Advertisement
Smart TVs
Lord_ghost/Getty Images
Let’s not beat around the bush: your smart TV could be spying on you. It’s something most people never think of, and yet at the same time, it’s completely unsurprising. Tech companies are some of the biggest privacy abusers. Why wouldn’t they take the big screen situated in your living room, the locus of your home’s activity, and track its behavior? Consumer Reports explains how smart TVs use ACR (automatic content recognition) to track you. Basically, ACR is “watching” what you watch, compiling and analyzing that info, and then using it to recommend further content. That Consumer Reports article also has a guide on how to disable ACR in most major TV brands.
In the past, we’ve seen companies do all sorts of spooky things with smart TVs. Samsung was once caught saying that it would collect personal data unrelated to a voice command query over your microphone (the clause has since been removed from Samsung’s privacy policy). There was also that thoroughly dystopian UAB (unique audio beacon) tech that allowed advertisers to figure out who exactly was watching their ads by pinging nearby smartphones with inaudible, ultrasonic noise. Case in point, tech companies have stooped to some disturbing stuff before, and they might try again.
Advertisement
However, we’re not saying you should throw away your fancy OLED panel in favor of an old CRT. Just do some digital hygiene. Go into your smart TV’s settings and disable analytics and ACR; disable features you never use, like the microphone for voice commands; learn how to disable ads on your TV, if possible. If you do all your watching through a streaming box, then you might even disconnect the smart TV from Wi-Fi entirely, since the streaming box is the only thing that needs to be connected.
Advertisement
Smart glasses
David Becker/Getty Images
Smart glasses with cameras seem like a cool way to film things hands-free… except when they enable loathsome individuals to secretly film others in public. We’ve already discussed at length where Meta Ray-Bans and their ilk should and shouldn’t be used, and laws are already in the pipeline to curb their misuse, but it’s not just unsavory people using the glasses for unsavory purposes — It’s the companies, like Meta. They’re not as concerned with filming other people as much as filming you, the user.
The Electronic Frontier Foundation reports how Meta’s smart glasses in particular don’t have any strictly-offline functionality. AI voice chats and media recordings get pumped into the cloud and may in some cases see employees annotating them for AI training. It would appear, according to a Svenska Dagbladet investigation, that users may not always control what’s recorded and uploaded. Imagine going to the bathroom with the glasses on — but not recording — and someone on the other side of the world seeing the whole thing. One of the workers quoted in the aforementioned report said that the stuff they see on a daily basis would unleash “enormous scandals.”
While you might think that the same privacy risk applies to a smartphone, it’s important to remember that a smartphone isn’t sitting on your face, pointed at your surroundings whether or not you’re using the camera. Smart glasses inherently introduce a new class of privacy risk. Considering Meta is up to its neck in a huge class action lawsuit as a result of everything we’ve mentioned, we’d say this is the one device on this list most should avoid entirely.
Advertisement
Doorbell cameras
Ira.foto.2024/Shutterstock
It’s impossible to deny the benefits of a doorbell camera. You can see who’s at your door — even when not at home — as a security measure, a means to avoid unwanted visitors, and a way to keep tabs on anyone who’s entered your property line. As you can probably guess, however, having a camera in your home that’s owned by a tech company requires trusting that only you will be able to see the footage. We’re not just fearmongering baselessly. Ring — one of the most popular doorbell camera makers in the U.S. — was accused by the FTC of spying on users without their consent.
There’s also been growing concern in recent years that the Ring cameras belonging to your neighbors are surveilling and tracking you. We all know that one curmudgeon who makes everyone’s life miserable at the HOA meeting, who spends half their day with a drawn curtain in one hand and a phone dialed to 911 in the other. Now that curmudgeon has a camera that’s on even when they sleep, a camera which footage they can pass along to the police and get them involved even when you’re innocent. And there are probably a lot of these cameras in your neighborhood.
Again, we wouldn’t necessarily advocate for getting rid of your Ring camera. Instead, go into the settings and change a few. Some of the things we’ve mentioned — like Ring Neighbors — can be disabled entirely. Of course, Ring is just one company on the market making these doorbell cameras. It doesn’t matter which brand you’re using. Limit what privacy settings you can, and be wary of any camera-enabled device that’s filming continuously in the background, 24/7.
Advertisement
Smart home devices
Drazen Zigic/Shutterstock
Once you get used to controlling your lights verbally with your smartphone’s AI assistant, it’s painful to go back to the olden days of getting up off the couch and switching lights on manually. Now, you can fill your home with an army of smart devices that make things more secure and convenient — and affordably so. Once again, we extend a gentle reminder that these tech devices are made by companies that may not respect your privacy, or even adhere to their own privacy policy. There’s ample evidence to suggest they’re listening in constantly, gathering information, and potentially sharing it. And if they’re not listening, the devices themselves may be vulnerable to hackers.
First we’d say, use common sense. Don’t put an indoor camera in your bedroom, for example, and be careful what brands you buy from. You only have to Google a device’s manufacturer name paired with keywords like “security vulnerabilities” to quickly find the ones to avoid. Don’t make common Wi-Fi mistakes like using weak, outdated encryption for your home network, since it’s the bedrock of your smart home. Consider keeping some “dumb” devices, like a non-smart front door lock, to limit the attack surface.
In truth, most of this stuff is basic security practice that you should already be doing on your PC and smartphone anyway. Things like setting strong passwords for smart home platforms, like Google Home, and keeping all devices updated to the latest software. Hackers love an easy, low-hanging fruit, so even doing the bare minimum makes you a much less desirable target.
John Ternus has been talking about focusing on Apple’s core strength of design once he takes over as CEO, and a now a questionable report extrapolates that this means he’ll shake up the design team.
John Ternus is now best known for taking over as Apple CEO from Tim Cook, but as recently as January 2026, he took control of the firm’s design team. Now according to Bloomberg, far from leaving that because of other CEO duties, he is planning to continue working on Apple’s whole design philosophy.
Reportedly, Ternus told staff that under him, Apple will “keep focusing on design, because design is core to what we do in Apple.”
He said that Apple has brought “truly incredible design” to customers, and done so more than any other firm. Ternus claims that the best-designed item that most customers have, is an Apple product.
Advertisement
“We’re going to make sure that stays the case,” he said.
There are no further details, although the report echoes claims from January 2026 that Ternus plans a shakeup of the design teams. What is clear, though, is that this is going to mark a clear difference between Ternus and his predecessor, Tim Cook.
Cook was once criticized by Steve Jobs for not being a product person, in the way that Jobs or Jony Ive would obsess over them. It’s repeatedly been reported that Cook did not often visit the design teams, and now it’s said that Ternus has already devoted a lot of his time to the design division.
The first products to come out under Ternus’s aegis will be the iPhone 18 range in September 2026, the month he officially takes over. It’s said that Apple is aiming to mark the 20th anniversary of the original iPhone with a series of new devices, including a new iPhone Fold, and AirPods with cameras, in 2027.
Advertisement
Even those, though, are already at the testing stage. So while Ternus has been involved with them, it could take a couple of years before Apple releases a device that was made entirely on his watch.
You must be logged in to post a comment Login