Security news.
Active zero-day exploitation dominated today's updates, with critical flaws weaponised in both Check Point gateways and N-able N-central servers within hours of public disclosure. Concurrently, international law enforcement delivered a massive blow to cybercrime infrastructure by dismantling key loader networks and dark web marketplaces. Security teams must also monitor urgent patches for enterprise appliances including Citrix NetScaler and Apache HTTP Server.
Check Point Zero-Day Exploited for Root Access
Attackers are chaining the PHP2Shell vulnerability with a local privilege escalation flaw (CVE-2026-123039) on Check Point Security Gateways to deploy the TSGA backdoor and wipe ESXi systems.
N-able N-central Hit by Active "4EverAble2Shell" Zero-Day
Threat actors began compromising N-central servers and deploying cryptominers within hours of PoC release, successfully impacting at least 21 servers, including 19 running Hotfix 2.
Operation Endgame Dismantles Gootloader, CastleRAT, and StealC
International law enforcement seized 235 servers, 257 domains, and 6.4 million stolen credentials used by malware operators for initial access and ransomware deployment.
New 'SignDrop' Zero-Day Targets Windows CLFS
Public exploit code demonstrates how a local user can abuse Common Log File System (clfs.sys) companion files and Windows Defender path redirection to escalate privileges to SYSTEM.
Citrix Releases Security Fixes for Critical NetScaler Flaws
Citrix addressed multiple critical vulnerabilities across NetScaler ADC and Gateway, including authentication bypass and memory overflow bugs (such as CVE-2026-120868) that can lead to remote code execution or DoS.
Apache HTTP Server Patches Critical HTTP/2 RCE Flaw
The Apache Software Foundation issued an emergency update addressing a critical flaw in the HTTP/2 module that allows unauthenticated remote code execution.
SilentAir Spies Hijack Telecom Nodes for SMS 2FA Interception
A sophisticated state-aligned group compromised carrier equipment across at least six Asian countries to eavesdrop on calls and steal 2FA text messages, primarily targeting users in Taiwan.
Worm-Like 'SCKit' Malware Spreads Across ScreenConnect MSPs
A newly identified malware toolkit leverages ScreenConnect intrusions to laterally move from compromised customer endpoints to technician workstations, broadening access across managed networks.