Cybersecurity briefing — May 30, 2026.

Rapid7 reports in-the-wild exploitation of Palo Alto Networks PAN-OS/Prisma Access when “authentication override” cookies are enabled and the same certificate is reused, allowing forged cookies to bypass VPN authentication. Though rated medium, the edge-facing nature and available proof-of-concept make this effectively critical—organizations should urgently patch, disable auth override, or use a dedicated certificate for cookies.

Source: Rapid7

The Dutch National Police and NCSC took down 200 command servers controlling a botnet comprising at least 17 million infected devices across PCs, phones, IoT, and routers. It’s one of the largest disruptions this year and should significantly blunt the botnet’s capacity for DDoS, credential stuffing, and proxy abuse.

Source: Help Net Security

Attackers are exploiting FortiClient EMS (CVE-2026-35616) to deliver a broad-spectrum infostealer to managed endpoints, masquerading as a legitimate Fortinet update executed via VPN scripting workflows. Fortinet admins should patch EMS immediately, audit update scripts and logs for suspicious activity, and review endpoint telemetry for anomalous “update” executions.

Source: Help Net Security

A critical argument-injection vulnerability in Gogs (CVSS 9.4) allows authenticated attackers to achieve remote code execution by submitting pull requests with malicious branch names. With exploit code public and no fix yet available, organizations should restrict PRs to trusted collaborators, isolate CI/CD runners, and monitor for suspicious repository events.

Source: SecurityWeek

Researchers showed websites can profile users by measuring Solid-State Drive access timing through the browser’s Origin Private File System (OPFS), enabling stealthy device fingerprinting dubbed FROST. Until browser mitigations arrive, limit high-risk web features in untrusted contexts, clear site data regularly, and consider hardened browser profiles for sensitive work.

Source: Help Net Security

Google shipped Chrome 148 with patches for 151 security issues, some critical and potentially exploitable for remote code execution. Enterprises should expedite browser updates across managed fleets and validate that any frozen/extended channels receive the applicable fixes.

Source: SecurityWeek

The new EO emphasizes disruption of cybercriminal networks, expanded intelligence sharing, and victim restitution—shifting federal focus beyond government systems to citizen and business impacts. While not immediately regulatory, it raises expectations for enterprise cooperation, faster incident reporting, and demonstrable security governance.

Source: TechTarget | SearchSecurity