Security news.
Today's security landscape is dominated by active exploitation disclosures, including zero-day attacks targeting Check Point firewalls and command injection flaws in UnrealIRCd added to CISA's KEV catalog. Meanwhile, law enforcement delivered a major blow to cybercrime by dismantling infrastructure used by Gootloader, CastleRAT, and StealC. Administrators also face critical patching imperatives for widespread database RCE vulnerabilities in PostgreSQL and ongoing attacks against remote management tooling.
CISA Adds UnrealIRCd and Check Point Zero-Day Flaws to KEV Catalog
CISA has mandated federal patching for actively exploited flaws in UnrealIRCd (CVE-2026-114713) and Check Point Security Gateways (CVE-2026-123039). Threat actors have weaponized both vulnerabilities for command injection and privilege escalation.
Check Point Gateways Exploited via PHP2Shell to Deploy ESXi Wipers
Attackers are chaining PHP2Shell vulnerabilities with a local privilege escalation flaw in Gaia OS to compromise Check Point Security Gateways, deploying a custom backdoor and wiping VMware ESXi infrastructure. Check Point has issued emergency hotfixes.
PostgreSQL Patches 52 Vulnerabilities, Including 22-Year-Old RCE Bug
A high-severity type confusion vulnerability (CVE-2026-6460, CVSS 8.8) allows authenticated database users capable of creating objects to execute arbitrary code with server operating system privileges. Full mitigation also requires recompiling custom C-language extensions.
Operation Endgame Disrupts Gootloader, CastleRAT, and StealC Infrastructure
International law enforcement seized 235 servers and 257 domains powering major malware distribution ecosystems, recovering roughly 6.4 million stolen credentials belonging to over 40,000 victims.
Worm-Like 'SCKit' Malware Abuses ScreenConnect to Target MSP Technicians
A newly identified toolkit targets managed service providers by abusing ConnectWise ScreenConnect sessions, spreading from infected customer endpoints directly onto technicians' management systems to broaden network access.
SilentAir Spies Intercept SMS 2FA and Telecom Calls Across Asia
Threat researchers uncovered a state-aligned campaign that compromised core telecommunications infrastructure across six Asian nations to hijack SMS-based two-factor authentication codes and intercept cellular communications.
Trezor Discovers Malicious Cellular Hardware Implants in Safe 5 Wallets
Hardware wallet manufacturer Trezor confirmed that select devices sourced via a third-party reseller contained rogue internal circuit boards engineered to capture recovery seed phrases and transmit them across cellular networks.
N-able Restricts N-central Features Amid Exploitation of RCE Bugs
Threat actors compromised at least 21 N-central servers using the 4EverAble2Shell and Agent2Shell vulnerabilities, forcing the vendor to restrict specific platform features while rolling out hotfix protections.