Check Point confirmed active exploitation of a critical authentication bypass in Remote Access VPN and Mobile Access when configured with the legacy IKEv1 key exchange. A certificate-validation logic flaw lets attackers establish a VPN session without a valid password; Check Point has hotfixes and recommends disabling IKEv1 and enforcing machine certificates immediately. Attacks have hit several dozen orgs, with at least one case linked to a Qilin ransomware affiliate.
Source: Check Point Blog
Linux kernel nftables bug (CVE-2026-23111) enables local root; exploit technique published
Exodus Intelligence detailed a use-after-free in the Linux kernel’s nftables subsystem that was patched upstream on February 5, 2026. The write-up includes an exploitation path to achieve local privilege escalation and container escape on affected systems, raising urgency for admins to ensure patched kernels are deployed across fleets.
Source: Exodus Intelligence
BerriAI LiteLLM flaw (CVE-2026-42271) actively exploited, added to CISA KEV
A command injection vulnerability in LiteLLM is being exploited in the wild and can be chained to unauthenticated remote code execution in some deployments. CISA added the bug to its Known Exploited Vulnerabilities catalog, pushing urgent patching and hardening of AI gateway components that broker access to model APIs.
Source: The Hacker News
TeamPCP supply chain campaign expands as more actors weaponize “Mini Shai-Hulud”
SANS ISC reports continued activity in the TeamPCP campaign, which turned a security scanner into an initial access vector and recently open-sourced the Mini Shai-Hulud framework. The U.S. government has formally flagged the campaign, and a broader set of adversaries is now adopting the tooling—raising the bar for software supply chain defenses and telemetry on build and pipeline systems.
Source: SANS Internet Storm Center
Meta: 20,225 Instagram accounts hijacked via flaw in AI-assisted support workflow
Attackers abused a vulnerability in Instagram’s AI-assisted High Touch Support process to trigger unauthorized password resets and take over accounts. The incident underscores growing risks from AI-powered operational tooling and reinforces the need for strong out-of-band verification and enforced 2FA on recovery flows.
Source: Help Net Security
GitHub removes 70+ Microsoft repos amid suspected Miasma worm infections, breaks CI/CD
GitHub took down dozens of Microsoft repositories tied to Azure and AI tooling after suspected worm-driven compromise, disrupting multiple CI/CD pipelines. The campaign reportedly hunts for cloud credentials and adapts quickly, highlighting the need for secret scanning, signed commits, and least-privilege automation tokens across software supply chains.
Source: The Register
Google patches 5th Chrome zero-day exploited in 2026 (CVE-2026-11645)
Google shipped an emergency Chrome update for another in-the-wild zero-day, the fifth exploited vulnerability this year. Security teams should accelerate browser updates enterprise-wide and validate that managed update channels are delivering the latest stable version to reduce exposure windows.
Source: SecurityWeek
You May Also Be Interested In...
CISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318)
WhatsApp catches spyware firm NSO defying no-hacking court order
The security questions around Chinese AI coding models in U.S. software