Anyone hear of a PoC for CVE-2026-0227 yet?

PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal

https://security.paloaltonetworks.com/CVE-2026-0227

Palo Alto Networks has released patches for a high-severity denial-of-service vulnerability (CVE-2026-0227) affecting its PAN-OS firewalls, which could cause them to enter maintenance mode and disrupt network availability.
https://www.csoonline.com/article/4117730/palo-alto-networks-patches-firewalls-after-discovery-of-a-new-denial-of-service-flaw-2.html

Cisco has patched a critical AsyncOS vulnerability (CVE-2025-20393) that was exploited as a zero-day by the China-linked APT group UAT-9686 to gain root access and install persistence mechanisms like the AquaShell backdoor on Secure Email Gateway and Secure Email and Web Manager appliances.
https://securityaffairs.com/186985/apt/china-linked-apt-uat-9686-abused-now-patched-maximum-severity-asyncos-bug.html

GLIBC-SA-2026-0002: getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler (CVE-2026-0915)

https://sourceware.org/pipermail/libc-announce/2026/000050.html

🟠 CVE-2026-22774 - High (7.5)

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.3.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leadi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22774/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Fascinating 🛡️ BodySnatcher (CVE-2025-12420): A Broken Authentication and Agentic Hijacking Vulnerability in ServiceNow 🛡️
Key Takeaways
AI agents significantly amplify the impact of traditional security flaws.
A Virtual Agent integration flaw (CVE-2025-12420) allowed unauthenticated attackers to impersonate any ServiceNow user using only an email address, bypassing MFA and SSO.
Virtual Agent APIs can become unintended execution paths for privileged AI workflows.
Internal topics such as AIA-Agent Invoker AutoChat enable AI agents to be executed outside expected deployment constraints.
Point-in-time fixes do not eliminate systemic risk from insecure provider and agent configurations.
Preventing abuse of agentic AI in conversational channels requires:
Strong provider configuration controls, including enforced MFA for account linking
Establishing an agent approval-process
Implementing lifecycle management policies to de-provision unused or stagnant agents.
https://appomni.com/ao-labs/bodysnatcher-agentic-ai-security-vulnerability-in-servicenow/ #InfoSec

The ServiceNow 'BodySnatcher' vulnerability (CVE-2025-12420) shows why AI's race to market is a security disaster. Unauthenticated attackers hijacking AI agents to bypass MFA? This is what happens when we ship AI without proper security. My latest: https://securityboulevard.com/2026/01/were-moving-too-fast-why-ais-race-to-market-is-a-security-disaster/

A critical vulnerability (CVE-2025-36911) in Google Fast Pair lets attackers forcibly connect to Bluetooth accessories like earbuds without consent, dubbed “WhisperPair.”

Attackers within 46 feet can control accessories to play audio or record conversations, and can track users by registering as device owners. Hundreds of millions of devices from brands like Sony, JBL, and Logitech are affected.

Google patched Pixel devices, but users must also update their accessory firmware for full protection.​​​​​​​​​​​​​​​​https://www.securityweek.com/whisperpair-attack-leaves-millions-of-bluetooth-accessories-open-to-hijacking/

Patch Now: Active Exploitation Underway for Critical HPE OneView Vulnerability
https://blog.checkpoint.com/research/patch-now-active-exploitation-underway-for-critical-hpe-oneview-vulnerability/

Check Point Research has identified an active, coordinated exploitation
campaign targeting CVE-2025-37164, a critical remote code execution
vulnerability affecting HPE OneView. The activity, observed directly in Check
Point telemetry, is attributed to the RondoDox botnet and represents a sharp
escalation from early probing attempts to large-scale, automated attacks.

Check Point has already blocked tens of thousands of exploitation attempts,
underscoring both the severity of the vulnerability and the urgency for
organizations to act.

On January 7, 2026 Check Point Research reported the campaign to CISA, and the
vulnerability was added to the Known Exploited Vulnerabilities KEV catalog
the same day.

TP-Link

https://www.cve.org/CVERecord?id=CVE-2025-9014

cc: @Dio9sys @da_667

#internetOfShit