Security news.
Today's security landscape is dominated by active zero-day exploitation and destructive campaigns targeting edge network appliances. Attackers are weaponizing vulnerabilities in Check Point gateways and N-able N-central servers, while critical patches roll out for PostgreSQL and Citrix NetScaler. Additionally, major law enforcement takedowns have dealt significant blows to criminal botnet infrastructure.
Check Point Gateways Exploited via PHP2Shell to Deploy ESXi Wiper
Attackers are chaining PHP2Shell vulnerabilities with a local privilege escalation flaw (CVE-2026-123039) on Check Point Security Gateways to gain root access and wipe virtual machines on VMware ESXi hosts.
Hackers Exploit New N-central Zero-Day Following PoC Release
Threat actors are actively exploiting a newly disclosed unauthenticated remote code execution vulnerability in N-able N-central, dubbed "4EverAble2Shell," to gain root control across dozens of servers.
CISA Adds Check Point and UnrealIRCd Vulnerabilities to KEV Catalog
CISA added two actively exploited flaws to its Known Exploited Vulnerabilities catalog, including the Check Point privilege escalation bug (CVE-2026-123039) and an UnrealIRCd delimiter issue (CVE-2026-114713).
PostgreSQL Fixes 22-Year-Old Flaw Permitting Authenticated RCE
PostgreSQL issued updates addressing 52 security vulnerabilities, headlined by CVE-2026-6460 (CVSS 8.8), an ancient type confusion bug that allows database users with object-creation privileges to execute arbitrary server code.
Citrix Patches 10 Critical NetScaler Vulnerabilities
Citrix has issued security fixes addressing 10 critical flaws across NetScaler ADC and Gateway appliances that could result in denial-of-service conditions or unexpected operational behavior.
Operation Endgame Dismantles Gootloader, CastleRAT, and StealC Servers
An international police effort seized 235 servers and 257 domains powering the Gootloader, CastleRAT, and StealC malware distribution operations, recovering roughly 6.4 million stolen credentials.
Hardware Implants Found in Trezor Crypto Wallets Sold by Reseller
Trezor confirmed that three Safe 5 devices sold by third-party vendor CryptoBilis were altered with unauthorized circuit boards engineered to exfiltrate recovery seeds via cellular networks.
SilentAir Hijacks Asian Mobile Networks to Intercept SMS 2FA Codes
A suspected state-sponsored cyberespionage group breached telecommunications nodes across at least six Asian countries to eavesdrop on calls and intercept multi-factor authentication SMS messages.