Company
Cybersecurity company providing managed detection and response services, with a threat research team that tracks emerging attack campaigns and vulnerabilities.
Qilin and Settra ransomware groups are exploiting CVE-2026-0257, a PAN-OS GlobalProtect and Prisma Access authentication bypass disclosed in May. ReliaQuest says access through a victim's own VPN can look like remote work until credential theft or ransomware deployment is underway.
Reality
Harmonic Security raised a $50 million Series B led by Crosspoint Capital Partners, lifting its total funding to $76 million. Calcalist put rival Prompt Security's sale at about $250 million on $23 million raised, the nearest price comparison.
Perspective Coverage
6 publishersReality
ReliaQuest reports ransomware actors are exploiting CVE-2026-0257, an authentication bypass in Palo Alto PAN-OS GlobalProtect and Prisma Access. The Bedrock Agents credential flaw Zenity found is already fixed.
Reality
ReliaQuest says Qilin and Settra ransomware groups are exploiting CVE-2026-0257, a PAN-OS GlobalProtect auth bypass disclosed May 13. Upgrading closes the entry point, but sessions opened before the upgrade may survive it.
Reality
Suspected Cl0p operators chain a FlexPLM WSDL disclosure to CVE-2026-12569 for unauthenticated code execution. No encryption stage means ransomware-tuned detections stay silent.
Perspective Coverage
7 publishersReality
Shell says it is investigating after Clop claimed 89GB of engineering data. It is one of 43 names the gang tied to a single flaw in internet-exposed PTC Windchill and FlexPLM.
Reality
A ReliaQuest employee gave up a password and an MFA push five days after the company named the .claims campaign. Device trust, not training, kept the session worthless.
Perspective Coverage
5 publishersReality
The distributor found the intrusion on August 25, 2026, the same day ShinyHunters says its four-day exfiltration ended. It has not named the vendor applications involved, so customers are left scoping their own integrations.
Perspective Coverage
9 publishersReality
ReliaQuest's tests show Exchange Online accepts unauthenticated mail when the visible From header matches the tenant domain and the SMTP envelope sender is left empty. Forty percent of those messages went to senior leaders.
Reality
ReliaQuest says an August 22 caller named a real colleague to steer staff onto a lookalike single sign-on page, and the password plus push approval that followed bought a brief session on its identity dashboard.
Reality
ReliaQuest says a custom JSP web shell decrypts LDAP admin secrets with Windchill's own API and indexes the design vault over existing database connections. Network telemetry sees very little.
Reality