12 stories · 2 sources · 3 critical · 3 high · ~12 min read
Coverage: Last 24 hours
Today’s Highlights
Critical vulnerabilities affecting Check Point Security Management, Orkes Conductor, Unbound DNS, and Docker Sandboxes expose core infrastructure to unauthenticated remote code execution and are already being targeted by adversaries. At the same time, defenders are confronting a new wave of AI-enabled malware and advanced backdoors delivering deeper persistence, evasive credential theft, and lateral movement across diverse environments. Organizations managing developer pipelines, mobile fleets, and high-value Windows endpoints need to act fast to address exposure and review underlying detection and response paradigms.
Table of Contents
- Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
- Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
- Critical Orkes Conductor Vulnerability Exploited in Attacks
- Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files
- Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords
- Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar
Critical High Medium Low
Top Stories
Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
Source: The Hacker News | Published: Sep 17 | Risk: CRITICAL | Impacted: Check Point Security Management Servers, Network security teams, On-premise firewall infrastructure | Topics: Vulnerability / Exploit
What happened: A critical vulnerability in Check Point’s Security Management and Log Servers allows unauthenticated attackers to execute code as root over the network. The flaw, identified as CVE-2026-91843, is a stack overflow in the login process and has been assigned a CVSS score of 9.8. Check Point has released a fix through its LivePatch update channel and urges customers to apply it immediately.
Why it matters: Unauthenticated remote code execution in security management products creates a straightforward path for attackers to gain root access and take over security controls, undermining the entire security architecture of an organization.
How it works: Check Point Security Management and Log Servers are used to orchestrate firewall policies and collect network logs. The flaw (CVE-2026-91843) is a stack overflow in the authentication handler, which allows unauthenticated attackers to execute arbitrary code on the management server.
Affected / Fix: Fix available via LivePatch update channel; patch immediately.
Practitioner Perspective
Check Point Security Management and Log Servers are central control points for policy enforcement and log collection on enterprise firewalls and gateways. CVE-2026-91843 allows attackers to execute code as root with no authentication required, so exploit attempts are likely inevitable on any instance with network exposure. Because this is a stack overflow in the login handler, network segmentation alone is not a sufficient mitigation if management interfaces are exposed. This is a critical-path patch: delay means risking full compromise of security controls. Assume exposed, unpatched systems are already being targeted.
Recommended Actions
- Install Check Point LivePatch update for CVE-2026-91843 immediately on all Security Management and Log Servers
- Audit current management server network exposure and restrict access to trusted management subnets only
Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
Source: The Hacker News | Published: Sep 17 | Risk: CRITICAL | Impacted: Organizations operating Unbound DNS servers, ISP and hosting providers, Internal corporate DNS services | Topics: Vulnerability / Exploit
What happened: Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wednesday. An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution. Unbound 1.26.1, released the same day, fixes the bug, tracked as CVE-2026-81642, along with
Why it matters: Attackers exploiting RCE in core DNS infrastructure can intercept, modify, or redirect organizational network traffic, threatening both internal security and external reputation.
How it works: Unbound is an open-source DNS resolver frequently deployed for DNSSEC validating. The bug (CVE-2026-81642) is a heap overflow in its DNSSEC validator, triggered by attacker-controlled DNS zones, which allows remote code execution on the resolver.
Affected / Fix: Affects all Unbound releases before 1.26.1; fixed in 1.26.1.
Practitioner Perspective
Unbound DNS is a widely deployed resolver supporting DNSSEC for integrity checking. CVE-2026-81642 is a heap overflow in the DNSSEC validator, which enables attackers controlling a malicious zone to remotely execute code. If your organization runs Unbound, especially if exposed to untrusted upstream queries, you need to patch to 1.26.1 without delay. Even internal-only DNS infrastructure can be weaponized as a pivot point if left vulnerable. Track adoption of patched versions and prioritize vulnerability scanning of all DNS resolvers.
Recommended Actions
- Upgrade all Unbound DNS instances to version 1.26.1 to mitigate CVE-2026-81642
- Isolate vulnerable DNS servers until patching is complete to reduce attack surface
Critical Orkes Conductor Vulnerability Exploited in Attacks
Source: SecurityWeek | Published: Sep 18 | Risk: CRITICAL | Impacted: Cloud automation teams, DevOps environments running Orkes Conductor, Workflow orchestration infrastructure | Topics: Vulnerability / Threat Intel
What happened: CVE-2026-58138 is an unauthenticated remote code execution vulnerability that attackers can exploit via inline workflow definitions. The post Critical Orkes Conductor Vulnerability Exploited in Attacks appeared first on SecurityWeek.
Why it matters: Orkes Conductor instances exposed to untrusted networks are subject to unauthenticated remote code execution, enabling immediate takeover of workflow automation infrastructure and possible pivoting to adjacent systems.
How it works: Orkes Conductor is used to orchestrate distributed workflows in cloud and microservices environments. CVE-2026-58138 allows unauthenticated attackers to execute arbitrary code via manipulated workflow definitions, bypassing user authentication completely.
Practitioner Perspective
CVE-2026-58138 affects Orkes Conductor and has already been exploited, meaning vulnerable systems are actively at risk if not patched. Because the vulnerability enables RCE via workflow definitions, attackers do not need valid credentials to execute arbitrary code. Many organizations use Conductor in cloud automation and integration, making it a potential entry point for broader compromise. Asset and workflow inventories should be reviewed to identify direct and indirect exposure, and network restrictions must be enforced while patch status is confirmed.
Recommended Actions
- Patch all Orkes Conductor instances for CVE-2026-58138 using official updates
- Hunt for indicators of compromise on all systems running Orkes Conductor, focusing on anomalous workflow execution logs
Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files
Source: The Hacker News | Published: Sep 17 | Risk: HIGH | Impacted: macOS Docker users, Developer workstations, CI/CD runners using Docker Sandboxes | Topics: Vulnerability / Exploit
What happened: A critical flaw in Docker Sandboxes on macOS allowed malicious code within a virtual machine to access and modify host files outside the shared project directory. This vulnerability, identified as CVE-2026-77179, was fixed in version 0.42.0 released on September 7, 2026.
Why it matters: Malicious containers exploiting sandbox escape on macOS can corrupt host files and compromise developer systems or sensitive application secrets, invalidating assumptions about container isolation.
How it works: Docker Sandboxes on macOS are intended to isolate containerized workloads from the host. The vulnerability (CVE-2026-77179) enables malicious guest code in the sandbox to escape and read or modify files on the macOS host, beyond the container’s intended scope.
Affected / Fix: Fixed in Docker Sandboxes version 0.42.0 released September 7, 2026.
Practitioner Perspective
Docker Sandboxes are often trusted to isolate untrusted code or workloads from the host system, especially in developer and CI environments. CVE-2026-77179 allows code inside a sandboxed virtual machine to access files outside the defined project space, directly exposing macOS host data to compromise or data theft. Anyone relying on Docker for sandboxing on macOS should treat pre-0.42.0 environments as vulnerable to lateral movement, unintended data modification, and leakage. This is especially applicable to developer laptops and CI runners processing third-party container builds. Assume host compromise is possible if malicious code lands in the VM.
Recommended Actions
- Upgrade Docker Sandboxes to version 0.42.0 or later to fix CVE-2026-77179 on all macOS systems
- Scan endpoints for unexpected file modifications or privilege escalations originating from Docker sandbox processes
Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords
Source: The Hacker News | Published: Sep 17 | Risk: HIGH | Impacted: At-risk Windows users, Organizations with political or journalist staff, Endpoints with Telegram or similar messaging platforms | Topics: Vulnerability / Exploit
What happened: The Iran-linked “hacktivist” persona Handala Hack has been linked to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility named CRUDEEXCLUDE. HEAVYGRAM enables remote command execution, system information discovery, data exfiltration, screenshot capture, DLL sideloading, file cleanup, and persistence via Windows autorun registry keys. CRUDEEXCLUDE prepares environments for subsequent malware deployment by configuring Microsoft Defender exclusion paths for defense evasion. The malware is often disguised as legitimate applications and has been used to target Iranian dissidents, journalists, and opposition groups.
Why it matters: Deployment of data-stealing backdoors that abuse messaging apps and defense evasion tooling enables sustained surveillance and post-exploitation activity against targeted users and their organizations.
How it works: HEAVYGRAM is a backdoor managed over Telegram channels, supporting full system reconnaissance, command execution, data exfiltration, and anti-detection features such as disabling AV via utility tools. It achieves persistence by modifying autostart registry keys.
Practitioner Perspective
The HEAVYGRAM backdoor, distributed under the guise of legitimate Windows apps, provides remote command and data theft capabilities, including the ability to bypass Microsoft Defender with tools like CRUDEEXCLUDE. This type of threat targets high-value users such as journalists, opposition groups, and dissidents, but the techniques (DLL sideloading, autorun persistence, Defender exclusion modification) are broadly applicable. Routine monitoring for unknown Windows autorun keys, Defender exclusion changes, and unrecognized Telegram-based connections is essential. Security teams must not rely solely on default AV or EDR settings; post-exploitation hunting should be a routine exercise for high-risk populations.
Recommended Actions
- Hunt for HEAVYGRAM IOCs, including suspect Telegram traffic and unusual autorun registry keys, on high-risk Windows systems
- Audit Defender exclusion path configurations for unauthorized modifications tied to CRUDEEXCLUDE
Exploits & CVEs
Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar
Source: The Hacker News | Published: Sep 17 | Risk: HIGH | Impacted: Vulnerability management teams, Organizations relying on periodic scan cycles, Environments with unpatched internet-facing assets | Topics: Vulnerability / Exploit
What happened: A new CVE drops. Your scanner finds it. The severity score looks ugly. But that still does not answer the question that matters: Can it actually be exploited in your environment? Mythos-class AI is compressing the time between disclosure and working exploitation, while many security programs still validate risk on weekly or quarterly cycles. The dangerous gap is no longer
Why it matters: With the time between vulnerability disclosure and in-the-wild exploitation shrinking, organizations that delay exploitability assessment risk exposure even before patch testing completes.
How it works: The vulnerability management process relies on scanners to identify exposed CVEs, but attackers increasingly use automation to quickly test and exploit those with high-impact potential. Exploitability assessment determines whether vulnerabilities are practically reachable in your real-world environment.
Practitioner Perspective
Automated vulnerability scanning alone no longer guarantees risk containment, as attackers quickly weaponize newly published CVEs. A move toward automated or semi-automated exploitability testing is now required to guide prioritization and minimize the ‘window of opportunity’ for adversaries. Those waiting for traditional patch cycles are conceding the initiative, especially in cloud or SaaS environments updated out-of-band. The most critical maturity leap is integrating exploitability validation into your triage workflow. Defenders should focus on CVEs with public proof-of-concept or known active weaponization.
Recommended Actions
- Integrate exploitability validation tooling for CVEs flagged by scanners in your triage process
- Shift to daily or continuous vulnerability scanning and assessment on perimeter assets
Also Today
- Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer: A threat actor, claiming to be a bug bounty hunter, developed the PhantomRaven JavaScript information stealer using a large language model (LLM) and distributed it through npm packages to steal authentication tokens and credentials.
- RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall: RatHat, attributed to China-based actors, uses AI and Android Debug Bridge (ADB) to persist on devices even after uninstall.
- ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories: Roundup of recent threats including AI-generated malware, exploited LocalAI instances, Oracle flaw patches, and insider SIM swaps.
- CISO’s Expert Guide to Agentic Pentesting for Websites: New guide outlines autonomous AI pentesting techniques and the changing timeline for exploitation vs. patching cycles.
- MIND Secures $72 Million for AI-Powered DLP: MIND raised $72 million to advance their AI-driven Data Loss Prevention (DLP) platform for enterprise clients.
- China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America: FamousSparrow, a Chinese-aligned group, has deployed the SparroWocky modular C++ backdoor in attacks on multiple Latin American countries.
Defensive Actions
- Install Check Point LivePatch update for CVE-2026-91843 on all security management and log servers as a top patching priority.
- Upgrade all Unbound DNS resolvers to version 1.26.1 immediately.
- Patch Orkes Conductor instances for CVE-2026-58138 using official updates and segment network access.
- Upgrade Docker Sandboxes for macOS to v0.42.0 or later and restrict developer use of untrusted images.
- Review npm package install logs and scan endpoints for PhantomRaven or credential stealing modules.
- Audit Android device ADB configurations and review for signs of RatHat malware persistence.
- Hunt for signs of HEAVYGRAM and CRUDEEXCLUDE on high-value Windows endpoints, specifically unauthorized changes to Defender exclusions and autorun keys.
- Integrate exploitability validation into vulnerability management triage and prioritize patching for CVEs with known public exploits.
What We’re Watching
- Proliferation and possible further exploitation of CVE-2026-91843 (Check Point), CVE-2026-81642 (Unbound DNS), and CVE-2026-58138 (Orkes Conductor).
- Emergent attacks leveraging Docker Sandboxes CVE-2026-77179; monitor for lateral movement and privilege escalation on macOS developer endpoints.
- Increases in AI-driven supply chain attacks leveraging large language models to automate evasive credential stealers distributed via npm.
- High-confidence targeting by Iran-linked backdoor campaigns (HEAVYGRAM) against journalists and political dissidents.
- Shifts in exploitability proof-of-concept publication cadence for new CVEs, potentially compressing defenders’ response windows even further.
Found this briefing useful? Follow the blog to get the next one as soon as it is published, and pass it along to a colleague who owns patching.
Categories: Cybersecurity Blog, Cybersecurity News
Leave a Reply