REPORTED DEVELOPMENT
At 12:30 PDT, Palo Alto Networks Unit 42 updated its CVE-2026-109618/109619 advisory with a European government-organisation compromise. It reports attackers reaching password hashes and MFA secrets within around two hours, establishing an NTLM relay tunnel and attempting Domain Admin escalation.
Behaviour was consistent with agentic attack tools, but AI attribution remains an inference rather than independent proof of autonomy. More than 22.6 million potentially exposed instances are not equivalent to confirmed vulnerable or compromised systems. This updates the known vulnerabilities, not a new CVE.
WHY IT MATTERS TO THE MARKET
Observed attempts, demonstrated compromises, inferred attack capabilities and economically proven impacts must be distinguished.