Check Point VPN RCE Flaws: CVE-2026-85102 & CVE-2026-85103
Check Point has issued emergency hotfixes for two critical CVSS 9.8 vulnerabilities affecting Security Gateways and Management Servers using Remote Access or Site-to-Site VPN.
Cybersecurity
Vulnerabilities, threat intelligence, malware, breaches and defensive engineering.
AI-Orchestrated Cyberattacks: Inside the CyberStrikeAI Campaign
Kaspersky researchers detail a malicious campaign targeting education sectors where attackers deployed CyberStrikeAI, an open-source framework using an LLM orchestrator for post-exploitation.
Ivanti Connect Secure Zero-Day Exploit Chain Patched
Ivanti has issued emergency patches for CVE-2026-111357 and CVE-2026-118527, two zero-day vulnerabilities actively chained with an authentication bypass to achieve unauthenticated root execution.
TraderTraitor Binance Breach: Staging and Multi-Chain Attack
FBI and TRM attribute the multi-billion-dollar Binance breach to North Korean group TraderTraitor. The attacker staged tests across multiple wallets before compromising production hot wallets.
F5 BIG-IP APM Heap Overflow CVE-2026-94127 RCE Mitigation
Examine CVE-2026-94127, a critical heap-based buffer overflow in F5 BIG-IP APM allowing unauthenticated remote code execution. Learn indicators and remediation.
WordPress Core Upgrade Race Condition RCE Vulnerability Analysis
WordPress Core versions 4.7 through 7.1.3 contain a high-severity remote code execution vulnerability driven by a predictable upgrade staging path and a narrow race condition window.
Analyzing the Claude Code Extension SSH Backdoor Supply-Chain Attack
A tampered build of the Claude Code extension deployed an automated SSH backdoor and persistence mechanisms to up to 5,000 developer workstations.
Drupal Commerce Core Flaw CVE-2026-118539 Under Active Attack
Drupal maintainers have issued an urgent patch advisory for an actively exploited access bypass vulnerability in Commerce Core. CVE-2026-118539 allows unauthenticated attackers to manipulate routes and entity fields.
Cursor Marketplace Attack Backdoors Anthropic Extension
A supply-chain compromise of Anthropic's official extension on Cursor exposed up to 5,000 developer environments to reverse SSH backdoors and environment credential harvesting.
CVE-2026-97229: Alpine Incident Exposes Custom Ruby Build Risks
Alpine Linux rebuilt its GitLab infrastructure after an attacker probed CVE-2026-97229, revealing how non-omnibus deployments missed vendor-bundled Ruby fixes.
Analyzing Q3 2026 Incident Response Trends and EDR Killers
An in-depth technical analysis of Q3 2026 incident response trends highlights rising ransomware demands, BYOVD EDR tampering, and persistence techniques.
Hitachi Energy Patches TRO600 Arbitrary File Read Flaw
Hitachi Energy has patched two security vulnerabilities in its TRO600 series routers, including an unauthenticated arbitrary file read vulnerability that exposes sensitive configuration and password data.