VulnHub

Check Point has reported that hackers are actively exploiting a serious vulnerability known as CVE-2026-85102, which allows for remote code execution (RCE) in the VPN certificate-handling feature of its Security Gateway product. This flaw is particularly concerning because it can be exploited without authentication, meaning attackers do not need a valid username or password to take advantage of it. Organizations using affected versions of the Security Gateway are at risk, as this vulnerability could allow attackers to execute malicious code remotely. Users are urged to take immediate action to secure their systems, as the exploitation is already happening in the wild. Ensuring that security measures are in place is crucial to prevent potential breaches.

A critical vulnerability in WordPress, identified as CVE-2026-87902, is currently being exploited by hackers. Initially, attackers were probing for sites that were vulnerable, but they have now escalated to exploiting the flaw to write files to disk that can execute shell commands when accessed. This puts numerous WordPress installations at risk, particularly those running outdated or unpatched versions of the software. Users and website administrators need to take this threat seriously, as the exploitation can lead to unauthorized access and control over affected sites. This situation underscores the importance of timely updates and security measures in maintaining website integrity.

At a recent DefenseTalks event, Katie Sutton, the Pentagon's cyber chief, revealed that the demand for cyber operations has significantly outstripped the capabilities of U.S. military forces. Since gaining authority to conduct cyber operations eight years ago, the Pentagon has been inundated with requests, indicating a growing reliance on cyber capabilities for national defense. This surge in demand reflects the increasing complexity and frequency of cyber threats that the military faces today. As adversaries become more sophisticated, the Pentagon needs to find a way to expand its cyber operations to keep up with these challenges. This situation raises concerns about national security and the military's ability to protect critical infrastructure and respond to cyber incidents effectively.

Researchers have discovered a new method of distributing Go-based malware through a centralized repository operated by HashiCorp. This marks a significant shift, as attackers are now using Terraform providers and Go modules to deliver malicious payloads. The specific malicious modules identified are 'gocommunity-io/dockerd' and 'kreuzwenker', which have been downloaded a combined total of 222 times. This incident raises concerns about the security of widely used development tools and platforms, as it demonstrates that even trusted repositories can be exploited to spread malware. Developers and organizations need to be vigilant and scrutinize the sources of their dependencies to avoid potential infections.

A security issue has been discovered with GitLab's email feature for filing issues. Each user is assigned a private email address that, if obtained by someone else, can be used to push code and run Continuous Integration (CI) jobs in the user's name. This means that anyone with access to this email address can submit changes to any branch the user can push to, including the main branch. This vulnerability poses a significant risk as it allows unauthorized code submissions and could lead to malicious alterations in projects. GitLab users need to be aware of this issue to safeguard their accounts and projects from potential exploitation.

A group of cybercriminals has exploited open-source AI tools to target online retailers, resulting in the theft of over 600,000 credit card records. These attackers have infected more than 100 websites with malicious skimming scripts, allowing them to capture sensitive payment information from unsuspecting customers. This incident poses a significant risk to both consumers and businesses, as compromised credit card data can lead to fraudulent transactions and financial loss. Online retailers must take immediate action to secure their systems and protect customer data. Users should also monitor their bank statements and consider using virtual cards for safer online shopping.

Researchers have identified a serious vulnerability affecting MikroTik routers that allows attackers to gain full administrative control without needing a password or SSH key. Known as the MikroTrick chain, this issue arises from two flaws in the RouterOS software: an SSH state-machine vulnerability (CVE-2026-67279) and an argument-injection bug in the login process (CVE-2026-86060). These vulnerabilities can be exploited on routers that are exposed to the internet, putting numerous devices at risk. Users of MikroTik routers should take immediate action to secure their devices, as the potential for unauthorized access could lead to significant data breaches or network disruptions.

In the first half of 2026, the United Arab Emirates and Saudi Arabia faced a significant increase in cyberattacks, accounting for half of all incidents reported in the Gulf region. These attacks have become more complex, posing serious challenges for cybersecurity teams in both countries. The rise in incidents affects various sectors, raising concerns about the security of sensitive data and critical infrastructure. This situation highlights the urgent need for enhanced cybersecurity measures and collaboration among nations to combat these evolving threats. The implications of these attacks could be far-reaching, affecting not only businesses but also national security and public trust in digital systems.

Researchers at GitGuardian have discovered 474 leaked GitHub App keys that are still active and capable of authenticating, including some with admin access. This situation poses significant risks as these keys can allow unauthorized users to access and manipulate repositories. The affected keys could potentially lead to data breaches or unauthorized changes in projects hosted on GitHub. Developers and organizations using GitHub should immediately review their app keys and regenerate any that may have been compromised to prevent misuse. This incident serves as a reminder of the importance of securing sensitive credentials and regularly auditing access permissions.

A recent report from InfraTrust indicates that attackers are increasingly focusing on network management systems that control enterprise infrastructures. This trend involves exploiting several serious vulnerabilities soon after vendors disclose them, raising alarms for organizations that rely on these systems for their operations. The implications are significant, as compromised management systems can lead to unauthorized access and control over critical network resources. Companies using such systems need to ensure they are updated and patched against these vulnerabilities to protect their environments. The report emphasizes the urgency for proactive measures in securing these essential components of enterprise networks.

Threat actors have compromised two legitimate MemTensor packages on the npm and PyPI repositories to distribute a malicious program called sckit. This implant targets Windows, Linux, and macOS systems and is designed to steal credentials. Researchers from Aikido, SafeDep, Socket, and StepSecurity have reported on the affected libraries, particularly the @memtensor/memos-cloud-openclaw-plugin versions. This incident raises significant security concerns for developers and users who may have unknowingly installed these compromised packages. It's crucial for affected users to take immediate action to safeguard their systems.