The Watch

The Situation

Palo Alto Networks disclosed CVE-2026-0300, a buffer overflow in the PAN-OS User-ID Authentication Portal. It is already being exploited in the wild. No patch exists. The vendor's own ETA is mid-to-late May, which puts the device guarding the perimeter in a two-week window of targeted, unpatched exposure.

Three independent intelligence sources confirm active exploitation. The target is internet-facing PAN-OS instances with exposed management planes. Once the firewall takes RCE, the attacker sits upstream of detection. VPN logs, east-west inspection, and NDR telemetry are all suspect from that moment on.

PAN-OS perimeter bugs follow a predictable arc. A PoC lands within days of disclosure, mass scanning follows within hours. Anyone unpatched by the weekend is part of someone else's telemetry.

Why This Is Different

This is not a one-off. Ivanti, Fortinet, Citrix, and Cisco ASA have taken turns in the same chair over the past 18 months. Security infrastructure itself is the priority target. Edge devices with management planes reachable from the internet are the shortest path in. "Reachable" includes boxes whose owners would swear otherwise.

Running in parallel: CVE-2026-23918 in Apache HTTP/2, DoS with potential RCE across one of the most widely deployed web servers on the internet. PoC is likely imminent. Reverse proxies, load balancers, and legacy app tiers are all in scope. The two CVEs land on the perimeter and the web tier in the same maintenance window.

Cross-Source Assessment

Sources disagree on one point: whether PAN-OS exploitation is narrow and targeted or broad and automated. One source says "assume exploitation is broader than the advisory implies, because that is how these stories have gone every time for the last three years." Another frames it as management-plane-specific. Plan for the broader scenario.

Interim Mitigations

• ACL the User-ID Authentication Portal to named source ranges only. This is the minimum viable control
• Pull management interfaces off the public internet today
• Enable enhanced auth logging and deploy vendor-provided threat prevention signatures
• Pull device logs for unexpected admin sessions, config changes, and outbound traffic originating from the firewall itself
• Rotate device admin, API, and VPN credentials terminated on the appliance
• For Apache: disable HTTP/2 on non-essential endpoints and deploy WAF virtual patches for HTTP/2 frame anomalies

Campaign Overview

Supply-chain compromise of DAEMON Tools, signed installers, vendor website. Since April 8, 2026, installers pulled from AVB Disc Soft's own distribution have carried a backdoor signed with AVB Disc Soft's legitimate code-signing certificate. That puts the adversary inside the build or signing pipeline. Kaspersky counts thousands of stage-1 infections. A second-stage QUIC RAT has been deployed to approximately 12 targets, spanning government, scientific, manufacturing, and retail verticals in Russia, Belarus, and Thailand.

Same pattern as CCleaner in 2017 and Notepad++ in 2025. Infect broadly, select narrowly, pivot on reconnaissance telemetry. Every host running DAEMON Tools is now a row in someone's selection database.

Technical Details (MITRE ATT&CK Mapping)

Why This Matters Beyond the Dozen Targets

The twelve confirmed victims are the point of the campaign. They are not the point of the exposure. Stage-1 profiles every host it lands on, and the selection decision can be made weeks later against cached telemetry. Non-targets are catalogued, not spared.

Five separate intelligence sources place DAEMON Tools across the same five host populations: developers, IT admins, forensics workstations, QA teams, and shadow IT on developer laptops. Rarely in the managed software catalog. Frequently on high-privilege endpoints.

The Trust Model Failure

Publisher-based allowlisting does not survive this. The vendor's certificate is the delivery mechanism. The same control that failed for CCleaner nine years ago has failed again, for the same reason. Behavioral telemetry post-install and provenance verification below the signature layer are what remain.

Hunt Guidance

• Pull software inventory across all managed endpoints, including BYOD and lab machines
• Quarantine any DAEMON Tools installer with a hash dated after April 8, 2026
• Search EDR/NDR for QUIC-protocol outbound C2 beacons
• Hunt the stage-1 reconnaissance signature: MAC, hostname, locale, DNS domain, and process/software enumeration bundled into a single beacon
• Cross-reference hits against published Kaspersky IOCs for attribution confirmation

What Happened

Multiple intelligence sources report the same disclosure: NSA is operationally using Anthropic's Mythos model to find zero-days in Microsoft products. Separately, Anthropic CEO Dario Amodei has stated on the record that Mythos has enumerated thousands of unpatched vulnerabilities across banks and governments, and put a 6-8 month window on Chinese frontier parity. That second number is Amodei's, not an independent estimate.

Publicly, the White House has designated Anthropic a 'supply chain risk.' Not-so-publicly, the same administration is pushing Mythos across federal agencies. Call it what it is: vendor-risk incoherence.

If NSA has Mythos-class capability, assume adversary parity inside 6-18 months via weight theft, open-weight catch-up, or independent development. The gap between a bug existing and a working exploit has collapsed.

What This Changes for Defenders

The CISA Response Signal

CISA is reportedly compressing its critical patch SLA from 14 days to 3 days, with the rumor mill attributing the move to an incident tagged 'Claude Mythos.' Treat the trigger as unverified. The direction is not: a 30-day Patch Tuesday window is no longer a safe planning assumption for internet-facing Microsoft assets.

Cross-Source Tension

Sources disagree on imminence. One calls it "a step on the cost curve, not a break from it" — noting that fuzzing, symbolic execution, and LLMs have each been billed as the end of the patch cycle, which is still here. Another treats it as an immediate operational shift demanding 72-hour SLAs now. Both are right: the structural trend is real and gradual; the specific Microsoft surface NSA is working deserves an accelerated response this quarter.

What to Watch

• Whether Microsoft's advisory cadence shifts over the next two quarters
• Whether CISA KEV starts listing Microsoft bugs with no prior public research trail
• Whether any frontier lab confirms or denies government operational use on the record

The Pattern

Four credential and identity techniques surfaced this week. Each defeats a different control that defenders assumed was working. The scope runs from Active Directory persistence to MFA bypass to browser credential stores. None of these are traditional CVEs with patches coming. Three are by-design behaviors. Defenders carry the hardening and detection work.

1. Ouroboros — Windows Server 2025 dMSA Credential Extraction

Huntress and Akamai published a technique for extracting credentials from Delegated Managed Service Accounts (dMSAs) on Windows Server 2025. Microsoft reviewed it and declined to patch, classifying the report as below the servicing bar. That makes it a permanent detection problem, not a transient one.

Detection targets: unusual S4U2Self requests, PKINIT authentication from dMSA principals, and modifications to msDS-DelegatedMSAState by non-admin accounts.

2. CloudZ RAT Pheno Plugin — Phone Link OTP Theft

Cisco Talos documented a CloudZ RAT plugin called Pheno that targets Microsoft Phone Link and lifts OTPs from synced SMS. The phone is never touched. The paired workstation is the pivot. SMS-based MFA is defeated without any access to the handset.

3. Device Code Phishing — Now Commoditized

Proofpoint tracks multiple clusters running device code phishing, and a new PhaaS platform called ODx ships the capability as a product. In the same window, Microsoft caught an AitM campaign hitting 13,000+ organizations in 26 countries with 'code of conduct' lures. MFA is bypassed end-to-end in this flow.

4. Microsoft Edge Plaintext Passwords

Microsoft Edge loads stored passwords into process memory in plaintext. Microsoft has publicly called this a feature. No CVE will be issued. No patch is coming. Every infostealer family that reads browser memory now collects the credential vault without touching DPAPI.

Combined Impact

The common thread: in each case the vendor dismissed the technique or classified it as acceptable. Defenders carry the full weight. Budget accordingly.