Product Marketing Manager - Cloud Native Apps, CTO Office

Hackers exploit Palo Alto VPN flaw to bypass MFA and steal credentials from VMware disks. Ransomware operators are exploiting a Palo Alto Networks GlobalProtect VPN flaw to bypass multi-factor authentication and enter corporate networks. In one investigated case, attackers reached VMware management systems and stole credentials directly from a domain controller's virtual disk, avoiding security tools running inside the virtual machine. Palo Alto Networks Unit 42 detailed the activity in an October 19 threat brief update. Researchers linked exploitation of CVE-2026-0257 to Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, also known as Inc. Separate public reporting connected exploitation to operators using Settra ransomware. Investigations ongoing since early June have covered healthcare, education, financial services, manufacturing, government, energy, and other sectors. The latest findings show how unauthorized VPN access can develop into credential theft, data theft, and ransomware deployment. GlobalProtect flaw bypasses MFA. The vulnerability affects GlobalProtect portals and gateways in certain PAN-OS and Prisma Access deployments. Exposure requires authentication override cookies to be enabled alongside a vulnerable certificate setup. Palo Alto Networks rates the flaw High, with a CVSS score of 7.8 and its highest suggested response urgency. Panorama and Cloud NGFW are not affected. Authentication override cookies let previously authenticated users reconnect without repeating the full login process. According to Rapid7's technical analysis, vulnerable devices decrypt these cookies but do not properly verify that a trusted system created them. If the cookie certificate is reused for a publicly exposed service, attackers can obtain its public key and forge a cookie. The gateway may accept that cookie as proof of authentication, allowing a VPN connection without the normal login and MFA checks. Cybersecurity News previously covered this GlobalProtect authentication bypass. After establishing access, attackers use remote monitoring and management tools to explore internal networks. They move between systems through Remote Desktop Protocol and Server Message Block, then prepare tools for credential harvesting, data theft, and ransomware deployment. The most notable case involved a move from the compromised VPN gateway to VMware's vCenter management appliance. Attackers then disabled the execInstalledOnly security control on ESXi hosts and used a custom tool to extract credentials offline from a domain controller's VMDK virtual disk. Unit 42 did not name the tool or provide its implementation details. Reading credentials directly from the disk bypasses endpoint detection and response controls inside the affected virtual machine. The approach targets the infrastructure beneath the operating system rather than relying on a credential-stealing program running within it. Cybersecurity News has also reported on VMware attacks involving detached domain controller disks. Unit 42 also observed attackers combining this initial access with tools targeting Veeam backup infrastructure through CVE-2023-27532. That separate flaw can expose encrypted credentials stored in the backup configuration database, potentially opening access to backup hosts. Defenders should examine GlobalProtect logs for successful gateway-connected events linked to suspicious sources and client details. Reported indicators include 104.207.144[.]154, 146.19.216[.]125, device names GP-CLIENT and DESKTOP-GP01, and host IDs aa:bb:cc:dd:ee:ff and 00:11:22:33:44:55. Earlier monitoring found that many probes did not establish full VPN sessions, making connection events important for investigation. Organizations should follow the Palo Alto Networks advisory and upgrade every affected portal and gateway. Temporary mitigations include disabling authentication override or generating a new certificate dedicated exclusively to override cookies. An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline. The post hackers exploit Palo Alto VPN flaw to bypass MFA and steal credentials from VMware disks appeared first on cyber security News.

Broadcom to advance NTT DOCOMO's private cloud with VMware Cloud Foundation. Company's first 10-year VMware software agreement in Japan strengthens infrastructure Resilience and lays the foundation for next-generation services. October 19, 2026 21:00 ET | Source: Broadcom Inc. TOKYO, Oct. 19, 2026 (GLOBE NEWSWIRE) - Broadcom Inc. (NASDAQ: AVGO), a global technology leader that designs, develops, and supplies semiconductor and infrastructure software solutions, today announced that it has signed a 10-year agreement with NTT DOCOMO, INC. (DOCOMO) to continuously advance the private cloud that will underpin the company's digital services over the next decade. The agreement will enable DOCOMO to continue delivering reliable digital services to its customers amid a rapidly changing business environment, marked by the expanding use of AI and increasingly sophisticated cyberattacks. Since 2019, VMware, now Broadcom, has worked closely with DOCOMO to build and operate its private cloud with VMware Cloud Foundation (VCF) at its core. Building on this collaboration, the two companies will now align their long-term technology roadmaps to strengthen DOCOMO's service infrastructure. This is Broadcom Japan's first (1) 10-year comprehensive agreement covering licenses, technical assistance and maintenance support for VMware products (2), including VCF. Through this agreement, Broadcom will combine DOCOMO's operational expertise in large-scale infrastructure with its technology and engineering resources to further improve the continuity, security and delivery speed of DOCOMO's service infrastructure. With VCF at the core, Broadcom will drive technical collaboration and operational excellence across three focus areas: Continuous Service Availability Leveraging VCF, DOCOMO will strengthen its ability to rapidly upgrade and maintain systems without service interruptions. Unified management of servers, storage, and networking will enable flexible capacity expansion to support future service growth. In addition, autonomous placement and scaling of system resources based on usage will maintain stable service quality even during traffic spikes. VCF Forte Support, which offers Broadcom's highest-level service-level objectives (SLOs), will help sustain continuous system operations. Proactive Security and Resilience To counter increasingly sophisticated cyberattacks and emerging AI-driven threats, DOCOMO will further strengthen rapid and continuous security measures by leveraging VCF capabilities that enable timely patching, together with predictive anomaly detection. Continuous visibility across the entire system through VCF, combined with AIOps initiatives, will enable early detection of and rapid response to anomalies. Close engagement with dedicated Support Account Managers (SAM) and Technical Account Managers (TAM) will also enable DOCOMO to quickly incorporate the latest technologies and security measures. Accelerated Service Delivery By leveraging VMware vSphere Kubernetes Service (VKS), the native VCF Kubernetes runtime, DOCOMO will run virtual machines and containers on a common platform and use development and operations automation to streamline everything from environment provisioning to service delivery. Automating development, testing and release processes will enable new services and features to be rolled out in shorter cycles, allowing DOCOMO to respond quickly to evolving customer needs and market conditions. Building on this long-term agreement, Broadcom will embark on the evolution of DOCOMO's service infrastructure into a next-generation platform that will bring together virtual machines, containers and AI. Leveraging a VCF-based private cloud platform, the two companies will jointly drive the automation and advancement of AI-driven operations that are expected to contribute to further improvements in service quality and delivery speed. Broadcom will continue to collaborate with DOCOMO to ensure that its service infrastructure evolves through the flexible adoption of new technologies, in anticipation of future shifts in technology and the business environment, such as the expanding use of AI, new AI-driven threats, 6G and IOWN. Executive Comments Hiroshi Ishimaru, General Manager, Service Design Department, NTT DOCOMO, INC. "At DOCOMO, we are enhancing our service infrastructure to ensure the stability and security that allow customers to use our digital services with peace of mind, while enabling it to respond flexibly and quickly to changes in technology and the market." "VMware products have long been used across a range of our systems, and through this long-term comprehensive agreement, we will further strengthen our technical collaboration with Broadcom. Going forward, while maintaining the reliable delivery of our existing services, we aim to build a service infrastructure that delivers new value to customers more quickly and reliably, with an eye toward future technological advances such as the expanding use of AI." Paul Turner, Chief Product Officer, VMware Cloud Foundation Division, Broadcom "We are honored to continue to partner with DOCOMO, a company that supports Japan's social infrastructure and digital lifestyles, on a long-term initiative for the next decade." "Over the past seven years, we have built a strong technical collaboration, and this agreement takes that relationship further, reflecting our shared commitment to continuously enhancing DOCOMO's service infrastructure over the long term. With VMware Cloud Foundation at the core, Broadcom will provide a private cloud platform that runs virtual machines, containers, and AI workloads on a common foundation. Our engineering teams will work closely with DOCOMO's so the company can continue to deliver secure, reliable digital services quickly." About Broadcom Broadcom Inc. (NASDAQ: AVGO) is a technology leader that designs, develops, and supplies semiconductors and infrastructure software for global organizations' complex, mission-critical needs. Broadcom combines long-term R&D investment with superb execution to deliver the best technology, at scale. Broadcom is a Delaware corporation headquartered in Palo Alto, CA. For more information, visit www.broadcom.com. Notes and Company Information | (1) | As a 10-year comprehensive agreement in Japan covering licenses, technical assistance and maintenance support for VMware products, as of October 20, 2026. | | (2) | VMware products and related technical assistance and support covered by the agreement include: VMware Cloud Foundation, VMware Avi Load Balancer, VMware vDefend, VMware Tanzu Platform, Support Account Manager (SAM), Technical Account Manager (TAM) and VCF Forte Support. | | / | / | Media Contacts: Roger Fortier VMware Cloud Foundation Division, Broadcom +1.408.348.1569 [email protected]