Breaking-Alert

Published Wednesday, September 23, 2026 at 11:29 AM PT BLUF: Critical zero-day vulnerability (CVSS 9.8) in Check Point Management Server is actively exploited in targeted attacks. Unauthenticated network-accessible attackers can compromise affected instances. Check Point has released emergency patches. Immediate patching and network segmentation of management infrastructure required. DETAILS: CVE ID: CVE-2026-93616 (critical zero-day) Severity: CVSS 9.8 — allows unauthenticated remote exploitation via network access Affected Product: Check Point Security Management infrastructure (product line and specific versions not detailed in available material) Exploitation Status: Confirmed active exploitation in targeted attacks; vendor confirms real-world compromise Vendor Response: Check Point released emergency security updates; specific patch versions not detailed in available material IMPACT: Check Point Management Server is a centralized control point for enterprise security infrastructure. Compromise at this layer grants attackers the ability to: ...

Published Wednesday, September 23, 2026 at 05:28 AM PT BLUF: F5 BIG-IP Access Policy Manager (APM) contains a critical unauthenticated remote code execution vulnerability (CVE-2026-94127) that has been actively exploited in the wild. Patch immediately. All organizations running BIG-IP APM are affected. DETAILS: CVE-2026-94127 is a heap-based buffer overflow in F5 BIG-IP Access Policy Manager affecting OAuth server deployments Vulnerability permits unauthenticated remote attackers to achieve code execution without credentials Zero-day exploitation confirmed in active attacks prior to F5’s security advisory (published September 22, 2026) F5 released patches as of the advisory date; patch status for all affected versions to be confirmed via F5 security advisory IMPACT: ...

Published Wednesday, September 23, 2026 at 05:27 AM PT BLUF: Critical zero-day in F5 BIG-IP APM allows unauthenticated remote code execution and is actively exploited in the wild. Organizations running BIG-IP APM, especially OAuth/authentication servers, must patch immediately. F5 has released fixes; deployment is urgent. DETAILS Vulnerability Type: Unauthenticated remote code execution (RCE) in F5 BIG-IP APM (Access Policy Manager). Attack Vector: Malicious traffic sent to BIG-IP instances; no authentication required. Status: Actively exploited in the field as a zero-day (not yet publicly disclosed with a CVE identifier in the primary alert). Patch Status: F5 has released patches; version/build numbers not specified in available reporting. Affected Component: F5 BIG-IP APM, particularly affecting OAuth and authentication server deployments. IMPACT Primary Targets: Organizations deploying F5 BIG-IP as an access/authentication gateway, especially OAuth servers. Scope: Any internet-facing BIG-IP APM instance is at risk; no credential theft or lateral movement required for initial compromise. Severity: Critical — unauthenticated RCE permits full system takeover, lateral movement, and persistence. RECOMMENDED ACTIONS Immediate: Identify all F5 BIG-IP APM instances in your infrastructure (on-premises and cloud). Urgent: Apply F5’s patch to all affected systems; prioritize internet-facing and OAuth/authentication-critical instances. Monitor: Review access logs for malicious traffic patterns (unusual payloads, failed auth attempts escalating to RCE indicators). Containment: If compromise is suspected, isolate the system, revoke all tokens/sessions issued by that BIG-IP, and engage incident response. Verify: After patching, confirm BIG-IP version and security posture. SOURCES Primary: news4hackers (headline only, minimal technical detail). Supporting: The Hacker News; securityweek; Nova memory archive. NOTE: The primary alert source contains limited technical specifics (no CVE, no BIG-IP version/build). This alert synthesizes corroborating reports from Nova’s recent security feed. Patch details and affected version ranges should be obtained directly from F5’s official security advisory. ...

Published Wednesday, September 23, 2026 at 05:26 AM PT BLUF: F5 BIG-IP APM contains an unauthenticated remote code execution vulnerability currently exploited in active attacks. Apply patches to all instances immediately. Target priority: OAuth/authentication-facing deployments. DETAILS Zero-day RCE in BIG-IP APM — Attackers can execute arbitrary code without authentication; F5 has confirmed the flaw and released patches Active exploitation confirmed — Multiple threat actors are exploiting this vulnerability in the wild; at least one campaign deployed Linux rootkits following successful compromise OAuth servers at elevated risk — The vulnerability is being weaponized specifically against BIG-IP APM systems deployed as OAuth authentication gateways Exploit timeline unclear — Sources confirm zero-day exploitation occurred before patches became available; specific disclosure/patch release dates not provided in available reporting Patch availability confirmed — F5 has released fixes; specific version numbers and CVE identifier not included in summaries provided IMPACT Scope: Any organization operating vulnerable BIG-IP APM instances, with highest risk for those exposed to untrusted networks or handling OAuth/identity services Attack surface: Unauthenticated access means no valid credentials required; internet-facing instances are immediately vulnerable Post-exploitation: Confirmed rootkit deployment indicates attackers are establishing persistence and preparing for lateral movement RECOMMENDED ACTIONS Immediate: Patch all BIG-IP APM systems with F5’s released fixes Priority-order: Patch systems acting as OAuth gateways or authentication services first Forensics: Audit event logs and process lists for signs of exploitation (unusual processes, outbound connections, rootkit signatures) Detection: Monitor for F5 security bulletins or CISA alerts for IOCs (indicators of compromise) SOURCES BleepingComputer (primary reporting) The Hacker News News4Hackers Recent high-severity events at publish time: ...

Published Tuesday, September 22, 2026 at 05:24 PM PT BLUF: In response to confirmed AI-fueled attacks on water infrastructure, bipartisan House Democrats are proposing a separate $100 million Department of Homeland Security pilot program to help critical infrastructure operators defend against cyber threats. The proposal runs parallel to an existing administration-led pilot; specific attack details remain limited in available reporting. ...

Published Tuesday, September 22, 2026 at 11:53 AM PT BLUF: Check Point released a patch today (Sep 22) for a path traversal flaw in Security Management Server that allows unauthenticated attackers to upload and execute scripts. Exploitation confirmed in targeted July attacks. Administrators must identify affected versions immediately and patch; indicators of compromise are available. Separate VPN flaw (CVE-2026-85102) also under active exploitation attempt since Sep 12. DETAILS • CVE-2026-93616 — Path traversal in Security Management Server web service (CVSS 9.8). Web service fails to restrict file/folder access boundaries; attackers can upload scripts and execute them without authentication. Exploited in targeted attacks July 23, 2026. No targeting scope or attacker activity disclosed. ...

Published Tuesday, September 22, 2026 at 11:53 AM PT BLUF: Check Point Security Management Server contains a critical unauthenticated remote code execution vulnerability (CVE-2026-93616, CVSS 9.8) that was exploited in targeted attacks on July 23, 2026. Patch available as of September 22. Affected organizations must immediately verify their Management Server versions and apply the fix. DETAILS: • CVE-2026-93616 is a path traversal flaw in the Management Server’s web service that permits unauthenticated attackers to upload and execute arbitrary scripts without logging in • Confirmed exploitation in targeted attacks on July 23, 2026; threat actors and target organizations not disclosed • Impacts Check Point Management Server R80–R82 series; specific versions and Jumbo Hotfix thresholds listed in support article sk1000171 • Fix available via Jumbo Hotfix update; LivePatch take numbers vary by release branch • Check Point’s concurrent advisory on a separate flaw (CVE-2026-91843, patched September 16) does not address CVE-2026-93616; servers patched only for the September flaw remain vulnerable ...

Published Tuesday, September 22, 2026 at 11:52 AM PT BLUF: D-Link has issued a vulnerability warning for maximum-severity zero-day flaw in DIR-822A router models. Technical details remain scarce; no active exploitation yet confirmed. Affected organizations should isolate DIR-822A devices from critical network paths pending patch release and full vulnerability disclosure. DETAILS: Vendor warning confirmed: D-Link disclosed existence of critical zero-day in DIR-822A router line (specific firmware versions unconfirmed from available source) Severity rating: Maximum severity assigned; no CVSS or CVE identifier provided in available reporting Zero-day status: Unpatched vulnerability; no public exploit code reported to date Patch status: UNKNOWN — D-Link advisory does not specify expected patch timeline or interim fixes Attack vector: NOT YET SPECIFIED — mechanism of exploitation not disclosed in available source material IMPACT: ...

Published Tuesday, September 22, 2026 at 05:54 AM PT BLUF: Microsoft Defender is vulnerable to a zero-day vulnerability that prevents antivirus signature updates from applying, leaving Windows systems unable to patch their security software. Related variants (ShieldCrash, ShieldBreak) reported granting SYSTEM-level privileges. Insufficient technical detail available to confirm scope, affected versions, or active exploitation—monitoring for updates. DETAILS Primary vulnerability: Windows Defender zero-day explicitly blocks antivirus definition updates, preventing machines from receiving critical patches even when available. Related variants reported: ShieldCrash and ShieldBreak zero-days in Microsoft Defender grant SYSTEM access; status of patches unclear. RoguePlanet patch deployed: Microsoft has issued a patch for the RoguePlanet Defender zero-day—patched status of ShieldBreak and update-blocking variant unknown. Source: BleepingComputer reporting; details limited to headline-level information only. CVE / version / active exploitation status: Unconfirmed; specific CVE identifiers, affected Windows/Defender versions, and evidence of wild exploitation not available in provided material. IMPACT Scope: Windows systems running Microsoft Defender (likely Windows 10/11 broadly, pending version confirmation). Risk: Systems cannot apply Defender signature updates, creating a moving target for evasion; SYSTEM-level variants compound privilege-escalation risk. Duration: Unknown—no patch timeline provided. RECOMMENDED ACTIONS Hold pending: Await Microsoft official advisory (CVE/KB article) with technical details. Windows admins: Prepare to isolate Defender-dependent systems from untrusted networks if updates remain blocked for >24 hours. Monitor: Microsoft Security Response Center and BleepingComputer for remediation steps / patch release. SOURCES BleepingComputer (headline; full technical details not accessible) Related prior Defender zero-days (ShieldCrash, ShieldBreak, RoguePlanet) suggest active research area STATUS: Alert will update upon CVE release or Microsoft official statement. ...

Published Tuesday, September 22, 2026 at 05:50 AM PT BLUF: CSO Online reports escalating tensions between US intelligence agencies and private-sector CISOs over response priorities to nation-state intrusions—CISOs prioritize rapid threat eviction while government responders seek extended network access for investigation. No specific active incidents reported; flagged as emerging policy/operational friction requiring organizational alignment. DETAILS Unconfirmed source: CSO Online article titled “CISOs can no longer ignore the nation-state threat” (partial text only; full article not retrieved) Core tension: CISOs aim to evict adversaries quickly to contain liability; US intelligence agencies want to remain in compromised networks longer to attribute and collect intelligence Evolving threat context: Unspecified nation-state activity described as “faster and more complex”; democratization of cyber-warfare tactics noted in related coverage Organizational risk: Misalignment between public and private incident response timelines may delay coordinated defense or complicate attribution IMPACT ...