🔥 Palo Alto Zero-Day RCE, 🎯 Iran Oman Espionage, 🛡️ Argo CD Secrets Leak, 💀 QLNX Dev RAT, 🔓 Azure AD Bypass

The PAN-OS zero-day is the day's defining story. CVE-2026-0300 is an unauthenticated buffer overflow in the User-ID Authentication Portal that gives remote attackers root on internet-exposed firewalls, is under active exploitation, and has no patch more than a week after disclosure. With over 5,800 exposed VM-Series devices, perimeter device inventories are the only mitigation until fixes land.

Supply chain is the theme underneath. The DAEMON Tools trojanization is the sharper case: digitally signed installers from the vendor's own website delivered a backdoor to thousands of systems across 100 countries, with the second stage reserved for a small set of high-value targets. The axios npm compromise was briefer but wider in blast radius; any pipeline that ran npm install in that three-hour window should be treated as fully compromised. DarkSword chaining six iOS zero-days and leaking to broader abuse widens the pool of commercial surveillance abusers.

The AI-infrastructure bug cluster is notable: Argo CD's ServerSideDiff endpoint leaks Kubernetes Secrets from etcd, Ollama's GGUF loader exposes 300,000 deployments to heap data theft, and n8n chains xml2js prototype pollution into unauthenticated RCE. None requires exotic access. Iran-linked operators breaching 11 Omani government entities through exposed webshells and ProxyShell shows how much stale Exchange debt still exists.

Watchlist: PAN-OS exposure and the May 13-28 patch window, DAEMON Tools install verification, Argo CD and n8n upgrades, and public AI workloads running with default bindings.