Check Point warns of active exploitation of Security Gateway VPN RCE

🕵️ RESEARCH & DEEP DIVES

• Check Point warns of active exploitation of Security Gateway VPN RCE flaw CVE-2026-85102
  Check Point has confirmed hackers are actively exploiting a pre-authentication RCE flaw in Security Gateway VPN certificate handling.

  • Affects Check Point Security Gateway (including Spark firewalls) and the Management web service; CVE-2026-85102 is a pre-auth RCE in VPN certificate handling, CVE-2026-93616 is a pre-auth path traversal allowing script execution and Java class loading.
  • CVE-2026-93616 has been exploited as a zero-day since July 23; exploitation of CVE-2026-85102 began September 12, 2026, after a Dutch NCSC alert on September 10.
  • Attackers used VPNs and proxies to hide their location, using certificates with subjects CN=vpn, CN=vpn-user, and CN=vpnuser (OU=users,O=global).
  • CISA added both flaws to its Known Exploited Vulnerabilities catalog with a September 25, 2026 deadline for federal agencies.
  • Fixes include LivePatch Take 26 or Jumbo Hotfixes (R81.20 Take 166, R82 Take 126, R82.10 Take 44, R81.10 Take 190) and Spark builds R82.00.10 Build 2325 or R81.10.17 Build 4968.
  Sources 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

• Hackers exploit critical WordPress path traversal flaw CVE-2026-87902 for code execution
  Attackers have moved from probing to actively exploiting WordPress flaw CVE-2026-87902 to write files that execute shell commands.

  • Applies to WordPress sites; fixed in version 7.1.2 with backports to all branches down to 4.7 (versions before 4.6 unfixed).
  • CVE-2026-87902 is an unauthenticated path traversal bug (CVSS 9.2) that can lead to remote code execution under certain conditions.
  • RCE requires a theme with a top-level directory starting with 'page-' and an attacker-chosen readable local .php file, e.g. pearcmd.php when PHP's register_argc_argv is active; the official PHP Docker image and default cPanel configs on PHP before 8.5 are affected.
  • Attacks escalated tenfold within a day of the patch; payloads write files to /tmp and /var/tmp with names like wp-pear-rce-flag.php, poc87902.php, luci_<random>.php, and zeta_<random>.php.
  • Probes use double-encoded traversal sequences in 'pagename' with a valid 'page_id'; source IPs 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b were observed.
  Sources 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

• FBI investigates ShinyHunters' alleged hack of FBIJobs.gov jobs portal and theft of employee data
  The FBI is investigating ShinyHunters' claimed breach of its jobs portal and theft of sensitive data on FBI employees and job applicants.

  • The FBIJobs.gov portal and FBI employee and job applicant PII are the alleged targets; ShinyHunters claims data on almost all FBI agents and job applicants was stolen.
  • The group claims to have hacked FBI services including Criminal Justice (CJ), HR, and Medlink.
  • ShinyHunters says it exploited a zero-day in Oracle's PeopleSoft HR platform; it is unclear whether the flaw was a zero-day or the vulnerability Oracle disclosed in June.
  • The group says the attack was retaliation for the FBI's May bulletin describing its activities, and demanded the FBI correct or remove the offending lines.
  • The FBIJobs.gov portal is currently offline; 404 Media confirmed a stolen data sample contained agents' sensitive personal information.
  Sources 📄 Source: x.com · 📎 Coverage: cybersecuritydive.com · 👁 via Cybersecurity Dive

• IonQ Unveils Single-CPU Real-Time Quantum Error-Correction Decoder
  IonQ has developed a quantum error-correction decoder that runs in real time on a single conventional CPU.

  • Applies to quantum computing: IonQ's decoder targets the classical computing overhead bottleneck in quantum error correction.
  • In simulations spanning up to 408 logical qubits across 88 memory blocks and magic factories, the decoder added as little as 0.02% processing time under standard operating noise.
  • The decoder runs end-to-end in real time on a single standard classical CPU, avoiding exponential scaling of classical hardware overhead as systems grow.
  • IonQ research lead Nicolas Delfosse says the work was validated across hundreds of logical qubits and millions of logical operations, with findings published on arXiv.
  Sources 📎 Coverage: securityweek.com · 👁 via SecurityWeek

• DHS watchdog finds most federal agencies failed to meet CISA cloud security directives
  A DHS inspector general report found most federal agencies failed to implement CISA's cloud security Binding Operational Directives.

  • Applies to federal agencies subject to CISA's cloud security Binding Operational Directives.
  • The DHS inspector general found most agencies failed to meet the directives, heightening their risk of attack.
  • The report said CISA lacks the power to compel agencies to implement its Binding Operational Directives.
  Sources 📎 Coverage: cyberscoop.com · 👁 via CyberScoop

• Pentagon cyber policy chief says demand for cyber operations far exceeds force capacity
  Pentagon cyber policy chief Katie Sutton said at DefenseTalks that requests for military cyber operations far exceed what the force can fulfill.

  • Applies to the Pentagon's cyber mission forces and commanders requesting cyber operations support.
  • Eight years after the 2018 authority treating cyber operations as traditional military activity, demand still exceeds supply.
  • Sutton's stated priority is expanding cyber options for the president and defense secretary, including using cyber to deny adversary data and as a tool below the level of armed conflict.
  • She said the Pentagon must become an 'AI-first organization,' flagging AI-specific risks like data poisoning and weakened guardrails.
  • She cited reported cyber operations during the Venezuela operation to apprehend Nicolás Maduro as an example of cyber entering the limelight.
  Sources 📎 Coverage: cyberscoop.com · 👁 via CyberScoop

🔓 CVEs & KEV

• CVE-2026-77254 — sooperset mcp-atlassian — CVSS 9.1 — MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured ...

• CVE-2026-77255 — sooperset mcp-atlassian — CVSS 8.6 — MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA u...

• CVE-2026-77262 — sooperset mcp-atlassian — CVSS 8.6 — MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_atta...

• CVE-2026-77257 — sooperset mcp-atlassian — CVSS 8.3 — MCP Atlassian: HTTP upload tools accept arbitrary server-local file pathsMCP ...

• CVE-2026-77253 — sooperset mcp-atlassian — CVSS 7.1 — MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary...

• VU#273940: Enterprise Access Management EAM does not rotate RSA keys — CERT/CC Vulnerability Notes

• Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry — The Hacker News

• sfturing hosp_order CommonUserServiceImpl.java cleartext storageA vulnerabili... — CVE ThreatInt

• Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoi... — CVE ThreatInt

• s2s-proxy accepts untrusted client certificatesAll published s2s-proxy versio... — CVE ThreatInt

• OpenC3 COSMOS: Authenticated remote code execution via the user-writable conf... — CVE ThreatInt

• Address Bar Spoof Risk; Missing Fullscreen Notification via Select ElementAn ... — CVE ThreatInt

• OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widgetOpenC... — CVE ThreatInt

• OpenC3 COSMOS: Authenticated OS command injection via the pypi_url settingO... — CVE ThreatInt

• WikiLambda public function execution bypasses the unsaved-code permission thr... — CVE ThreatInt

• Automation-controller: automation-controller-container: automation-controller... — <https://cve.threatint.com/CVE/CVE-2026-84499?utm_campaign=info&utm_medium=r