🔥 PAN-OS auth bypass CISA KEV, 🇳🇱 17M botnet disrupted, 🦠 DriveSurge ClickFix, 💻 JINX-0164 macOS malware, 🧵 npm dependency confusion campaign

The PAN-OS authentication bypass is the day's defining story. CISA added CVE-2026-0257 to the KEV catalog on May 29, confirming active exploitation of a GlobalProtect flaw that lets a remote unauthenticated attacker forge authentication override cookies and establish unauthorized VPN connections. Rapid7 documented two waves, on May 17 and May 21, some victims receiving full VPN IP assignments and internal network access. The vulnerability stems from zero signature verification on decrypted override cookies when certificates are shared with other services, so the fix is patching and not sharing certificates across features. GlobalProtect authentication bypass

The takedown and the supply chain item both matter. Dutch authorities disrupted a botnet of at least 17 million devices, seizing more than 200 servers tied to the Asocks proxy service, a reminder that much proxy capacity is built on infected machines. Separately, Microsoft detailed 33 malicious npm packages in a dependency confusion campaign: a single operator, three accounts, and nine organizational scopes, with inflated versions that win resolution over internal packages and a C2 in reconnaissance-only mode, toggleable to full exploitation. npm dependency confusion campaign

Two espionage operations are notable. Operation Dragon Weave targets the Czech Republic and Taiwan, using Azure Blob Storage as a dead-drop C2 with a SAS token valid through March 2027. JINX-0164 uses LinkedIn lures and custom macOS malware against cryptocurrency developers, and has compromised npm packages to deploy a Go backdoor.

Watchlist: patch GlobalProtect gateways, audit npm lockfiles for inflated-version packages, and detect cloud-storage dead-drop C2 patterns.