Qilin and Inc ransomware still exploit the GlobalProtect auth bypass patched in May

On October 20, 2026, Unit 42 confirmed that the Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc) ransomware groups are still exploiting CVE-2026-0257, the GlobalProtect authentication bypass that has been patched since May. If you run an exposed PAN-OS gateway, check your version and disable authentication override now.