ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More

This week's security roundup covers 27 stories ranging from active exploitation to critical patches. Palo Alto's PAN-OS GlobalProtect/Prisma Access flaw CVE-2026-0257 is now being weaponized by Qilin and Settra ransomware crews, with attackers blending in as legitimate VPN traffic. A new crypto drainer kit called Noir abuses DNS TXT records and DoH lookups to locate its Cloudflare-hosted backend, stealing funds without ever needing a seed phrase or private key. Researchers also flagged a self-healing WordPress must-use plugin that hides behind an EtherHiding Ethereum-based command channel, a Rust-based CikaBika Bot RAT using Discord for C2, and the disturbing KGB RAT, which pairs credential theft and ransomware with jump-scare "harassment" features. On the infrastructure side, a chained set of Adobe Experience Manager cloud bugs enables unauthenticated RCE, NVIDIA's Linux GPU driver carries CVE-2026-47595 (aka Bad UVM, CVSS 7.5) allowing privilege escalation and container escape, Samsung's QA-Board had a critical CVE-2026-110392 (CVSS 9.8) RCE bug—found by Claude Opus 5.5—and EG Secure Solutions' SiteGuard Server Edition is seeing active exploitation of CVE-2026-106931. Additional items include a Meta GitHub breach exposing data on roughly 1,500 people, a Harbor registry SSRF (GHSA-2phj-cp9f-qq6w, CVSS 8.5) enabling cloud credential theft, and a Xen grant-table race condition (CVE-2026-79610) risking VM-to-host escape across all versions since 4.0.