Month: September 2026

Check Point disclosed CVE-2026-93616, a critical pre-authentication path traversal vulnerability in Security Management Server that the company says was used in a small number of targeted attacks in July. A…

F5 has issued engineering hotfixes for CVE-2026-94127, a critical vulnerability in BIG-IP Access Policy Manager (APM) that has been exploited in the wild. The key scoping detail is configuration: the…

Japan dismantled its first North Korean laptop farm while the United States, Japan, Germany and Australia published a joint report on the broader WaterPlum campaign, SecurityWeek reported. The activity underscores…

Attackers used a compromised BigCommerce application key held by Ribon to access customer data, according to SecurityWeek. The incident highlights the access risk created when third-party applications hold broad or…

A malicious npm package named indexed-btree, presented as the legitimate sorted-btree package, accumulated millions of downloads, SecurityWeek reported. The package reportedly hid a malware trigger in a prototype method. Development…

A Chinese threat actor has targeted vulnerable Zyxel GS1900 switches worldwide for sensitive-information exfiltration, SecurityWeek reported. The activity follows reporting on active exploitation of a flaw affecting the switch line.…

WordPress has patched a vulnerability researchers call Click2Shell. According to SecurityWeek, the issue could let an attacker install themes and achieve remote code execution. Site owners should apply the relevant…

CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog on September 22 after evidence of active exploitation. The agency’s alert identifies the additions as affecting Check Point products. Organizations…