Check Point Management Servers Face Script-Upload Attacks
Check Point reports customer attacks through an unauthenticated management-server flaw. Match Jumbo Hotfix takes, restrict TCP/19009 and inspect CPM logs.
Reader edition
The Feed
AWS Quarantines an Exposed IAM Key While CloudTrail Names the User
A public-key exposure test reached AWS quarantine in 10 seconds. Alert on the IAM policy attachment, then investigate the key and follow the Support case.
Mandiant Details How Shared CI Caches Expose Release Builds
A pull request can plant dependencies in a shared build cache for a privileged release job. Separate cache writes by branch privilege and constrain publishing identities.
Attackers Exploit Two NetScaler Flaws That Permit Code Execution
CISA lists two exploited NetScaler flaws. Match ADC and Gateway builds to their release branches, then preserve evidence on appliances suspected of compromise.
Storm-3168 Deletes Azure Storage Accounts With Stolen Service Principals
Two compromised service principals drove a rapid Azure deletion campaign. Trace their ARM operations, rotate exposed secrets and verify recovery-resource locks.
Sogou's Link Handler Let UNC3569 Install GRAYRABBIT
A crafted Sogou URI reached an old, unsandboxed Chromium renderer. Verify the fixed build, then hunt the process, file, and network chain.
BlueMoon Exploit Kit Breaks Out of Chrome to Deploy Espionage Malware
Four espionage groups used a shared Chrome-to-Windows exploit chain. Build checks show current exposure; campaign artifacts support a separate compromise hunt.
RubyDoc Builds Let Malicious Gems Run Code on Shared Servers
More than 100 malicious gems used RubyDoc documentation builds to execute supplied code. Maintainers should review package and account changes tied to legacy API keys.
Attackers Exploit ScreenConnect Flaw to Run Files Without Host Approval
CISA confirms exploitation of CVE-2026-84869. ScreenConnect clients before 26.6.5 can transfer and run files through active sessions without authorization or host confirmation.
Attackers Exploit GitLab Flaw to Read Server Files Without a Login
An exploited GitLab flaw exposes arbitrary server files through the commits API. Self-managed operators should install 19.1.8, 19.2.6, or 19.3.2 immediately.
BigBear Phishing Bypasses Microsoft 365 MFA at 258 Organizations
CloudSEK found BigBear 2.0 stealing Microsoft 365 session cookies after MFA. Revoke sessions, rotate credentials and require phishing-resistant sign-in.
AOMEI Backup Driver Lets Local Users Rewrite Physical Disks
AOMEI Backupper 8.4.0 exposes physical-disk writes to local users. Without Secure Boot, attackers can plant UEFI code that runs before Windows defenses.
Check Point VPN Flaws Let Remote Attackers Run Code on Gateways and Servers
Two certificate-processing flaws reach gateways and management servers. Fixed takes and LivePatch output give operators a direct protection check.