Attackers are increasingly targeting the management systems used to control enterprise infrastructure, with several critical vulnerabilities actively exploited before or shortly after vendors disclosed them. This was reported in the September edition of Eclypsium's InfraTrust Pulse, a monthly report tracking security advisories affecting network devices, servers, firmware, chips, and other infrastructure. Between August 25 and September 17, InfraTrust tracked 158 new security advisories across 17 vendors, covering 1,699 vulnerabilities. Of those advisories, 42 were rated critical, eight had a maximum CVSS score of 10.0, and 71 could be exploited remotely without authentication. Five of the published advisories included vulnerabilities that ultimately made it on to CISA's Known Exploited Vulnerabilities (KEV) catalog.
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases. The adversary targeted multiple technologies, including PAN-OS Global Protect, FlowiseAI, Nuclio, Proxmox, Ubiquity, with exploits for known security issues. Scans and attacks attributed to the adversary originate from the same IP address and have been recorded since early June 2026, and have been attributed to a threat actor related to the Red Heron group, linked to exploiting a critical flaw in the Gitea self-hosted Git service. The activity was detected by threat intelligence company GreyNoise through its Global Observation Grid (GOG) network of sensors. According to the researchers, the threat actor leveraged the wp2shell vulnerabilities (CVE-2026-63030 and CVE-2026-60137) in the WordPress Core component to breach at least 49 organizations in 29 countries.
Check Point fixes an actively exploited flaw that lets unauthenticated attackers upload and run scripts on vulnerable Security Management Servers. Check Point has released emergency hotfixes for CVE-2026-93616, a critical path traversal flaw in its Security Management Server. The security firm bug is already being exploited. Attackers can abuse the flaw without logging in to upload malicious scripts and execute them on vulnerable servers. Because the Management Server controls security policies, admin activity and system logs across Check Point deployments, a compromise could have a wider impact on an enterprise network. The vulnerability affects more than Check Point’s main Security Management Server. The impacted products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Check Point fixed the issue in the R82.20 Security Hotfix and is urging customers to act quickly. The company revealed the flaw “is exploited in the wild” and that it is aware of a handful of customers who have already been attacked. The actual number of victims could be higher, since some compromises may go undetected or never be reported to Check Point. The company has also published indicators of compromise (IOCs) in its advisory, giving security teams a way to check their systems and logs for signs of an attack. If the hotfix cannot be installed immediately, the cybersecurity firm recommends placing the vulnerable system behind a firewall and allowing access only from trusted IP addresses. This can be configured through Manage & Settings → Permissions & Administrators → Trusted Clients in SmartConsole. It is only a temporary measure, however. Two weeks ago, the Dutch National Cyber Security Centre warned of two critical Check Point VPN flaws, tracked as CVE-2026-85102 and CVE-2026-85103, saying it expected exploitation attempts to start soon. In July, Check Point patched yet another critical authentication bypass, tracked as CVE-2026-16232, affecting Security Management and Multi-Domain Management (MDSM). The vulnerability, which is under active exploitation, allows unauthenticated remote attackers to obtain a SmartConsole login token and gain full administrative access. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, BigDiskBuster)
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zyxel flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Zyxel GS1900 Series Switches flaw, tracked as CVE-2026-7273 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is a stack-based buffer overflow that could allow attackers to execute arbitrary operating system commands. “A stack-based buffer overflow vulnerability in the CGI program of the Zyxel GS1900 series switch firmware could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.” reads the advisory. The vulnerability affects the CGI component of Zyxel’s GS1900 switch firmware. According to Zyxel, an unauthenticated attacker on the local network could exploit the flaw by sending a specially crafted HTTP request and potentially gain the ability to run OS commands on the device. The vulnerability has been fixed in the following firmware versions: Affected modelAffected versionPatch availabilityGS1900-82.90(AAHH.1)C0 and earlier2.90(AAHH.2)C0GS1900-8HP2.90(AAHI.1)C0 and earlier2.90(AAHI.2)C0GS1900-10HP2.90(AAZI.1)C0 and earlier2.90(AAZI.2)C0GS1900-162.90(AAHJ.1)C0 and earlier2.90(AAHJ.2)C0GS1900-242.90(AAHL.1)C0 and earlier2.90(AAHL.2)C0GS1900-24E2.90(AAHK.1)C0 and earlier2.90(AAHK.2)C0GS1900-24EP2.90(ABTO.1)C0 and earlier2.90(ABTO.2)C0GS1900-24HPv22.90(ABTP.1)C0 and earlier2.90(ABTP.2)C0GS1900-482.90(AAHN.1)C0 and earlier2.90(AAHN.2)C0GS1900-48HPv22.90(ABTQ.1)C0 and earlier2.90(ABTQ.2)C0 CISA did not disclose technical details about the attacks exploiting this issue or who is behind them. Zyxel credited Lei Gu, Jun Cao, Zhiqing Rui, Jingzheng Wu, and Tianyue Luo from ISCAS with finding and reporting the flaw. At the time of writing, Zyxel had not updated its advisory to confirm whether the vulnerability was being actively exploited. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by September 24, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Attackers are now actively exploiting a high-severity vulnerability in Zyxel GS1900 series switches, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The flaw (tracked as CVE-2026-7273) stems from a stack-based buffer overflow in the CGI program that lets threat actors without privileges on the local area network (LAN) execute OS commands via maliciously crafted HTTP requests. Zyxel released security updates to address this issue on June 16 and advised customers to upgrade their firmware "for optimal protection." While Zyxel has yet to update its advisory to confirm active exploitation of this flaw, CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) Catalog on Monday and ordered Federal Civilian Executive Branch (FCEB) agencies to secure their switches against ongoing attacks by Thursday as mandated by Binding Operational Directive (BOD) 26-04.
Hackers targeted two Colorado water utilities, changing OT settings and disabling alarms, but causing no impact on water services or safety. Foreign hackers targeted the operational technology (OT) systems of two small private water utilities in Colorado in late August, apparently trying to disrupt operations. Local authorities haven’t identified the affected utilities or the attackers. Attackers reportedly changed equipment settings, disabled remote access and alarms, and modified pumping cycles. The incidents were brief and did not affect water services or public safety. The utilities serve fewer than 200 people, and few technical details are available. The Colorado governor added the attack was carried out by ‘foreign actors’. “The intrusions did not affect drinking water quality or treatment processes, according to Colorado Gov. Jared Polis’ office. But the incidents add Colorado to a widening series of breaches in U.S. water and wastewater infrastructure.” reported Fox News. “These two incidents consisted of individuals changing equipment settings, disabling remote access and alarms, and altering pumping cycles,” Polis spokeswoman Ally Sullivan said in a statement. “These were brief incidents, and the risks were quickly addressed by the providers themselves, who subsequently alerted the state.” “We cannot confirm what foreign actors may have been involved, but we are aware of ongoing efforts across the nation by an Iranian-backed group to access drinking water and wastewater systems, as per the Cybersecurity and Infrastructure Security Agency,” Sullivan wrote in a separate statement. Despite references to Iran-linked attacks, there is no confirmation that the two Colorado utilities were part of the same campaign that targeted water facilities in at least a dozen US states in July. Federal authorities have not published a complete list of affected utilities. However, confirmed targets include facilities in Minnesota, Michigan, Alabama, Georgia, New Jersey, South Dakota,and Wisconsin. The available evidence does not currently establish a direct link between those attacks and the Colorado incidents. The recent attacks have renewed concerns about cybersecurity weaknesses in U.S. water infrastructure, especially at small and rural utilities that often have limited security staff and resources. In August, CISA urged water utilities to find and secure internet-exposed PLCs after July attacks showed how easily exposed industrial systems can be compromised. Over 100 internet-exposed systems in the US water and wastewater sector got hit by cyberattacks in July 2026, and CISA’s response wasn’t just an incident report, it was a how-to guide for making sure it doesn’t happen to you next. The agency’s exposure reduction guidance, published August 21, walks through exactly how organizations can find their own internet-facing weak points before an attacker does. The pattern behind the July attacks was surprisingly simple. Most of the affected systems were programmable logic controllers (PLCs), small industrial computers that control pumps and valves. Many connected directly to cellular modems and had no firewall or gateway between them and the internet. CISA warns that this type of setup can expose PLCs to serious security risks. “Directly connecting PLCs to the internet through cellular modems can create significant security risks. However, internet exposure reduction does not mean disabling necessary remote access; organizations should remove remote access when it is unnecessary and secure it when it is necessary.” states CISA. Hackers remotely accessed exposed PLCs, changed device IP addresses and passwords, and in some cases disabled shutdown processes and alarms, creating what CISA called unsafe conditions without notifying the operators running the actual equipment. Iran is the suspected actor behind much of this activity, likely tied to the ongoing war involving the US and Israel, though officials have stopped short of a formal attribution. Since fiscal year 2025, the EPA has identified more than 900 vulnerabilities across over 650 water systems and helped address about 700 of them at more than 500 utilities. The agency has also carried out more than 710 cybersecurity risk assessments and provided technical support to around 15,900 utilities. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, water utilities)
Check Point fixed CVE-2026-91843, a critical flaw that could let attackers run code as root on Security Management and Log Servers with no login needed. Check Point addressed CVE-2026-91843 (CVSS score of 9.8), a critical vulnerability in its Security Management and Log Servers. The flaw could let an attacker with no account run code as root over the network. The flaw sits in the login process before authentication. Censys researchers found that an attacker can trigger the stack overflow by sending a login request with an extremely long username. “This vulnerability may allow an unauthenticated attacker to remotely execute arbitrary code with root privileges through the login process.” reads the advisory. “At this time, there is no indication that this vulnerability has been exploited in the wild. However, due to its critical severity and potential impact, we strongly recommend taking immediate action to protect your environment.” Check Point said the attack path works only when customers use the Trusted Clients setting, which controls access to the management server through SmartConsole. Affected versions includes: R82.20 R82.10 Jumbo Hotfix Take 44 or lower R82 Jumbo Hotfix Take 126 or lower R81.20 Jumbo Hotfix Take 166 or lower R81.10 Jumbo Hotfix Take 190 or lower (EoS) R80, R80.10, R80.20, R80.30, R80.40, R81 (all EoS) Check Point released the fix through its LivePatch channel. Customers with automatic updates enabled should already have protection, while others need to apply the update described in advisory sk1000155. The company urged customers to act. So far, Check Point is not aware of real-world exploitation of the flaw. Censys reported no public proof-of-concept exploit as of September 16. Organizations should check their update status and apply the fix if required. These servers manage firewall and admin access, so teams should patch them quickly. Organizations should apply the LivePatch fix described in sk1000155. Customers who have automatic updates enabled should already have the fix. As an additional security measure, organizations should follow the recommendations in the Check Point Management and Gateway hardening best practices guide. They should also limit Trusted Clients access on the management server to specific, known internal IP addresses. “Censys observes 3,836 hosts globally carrying the Security Management/Log Server role, identified by the Security Internal Communication (SIC) identity Check Point assigns management servers by default rather than by version, since build and Jumbo Hotfix level are not visible in passive scan data.” reads the advisory by Censys. “This figure is total role presence, not a confirmed-vulnerable count.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CVE-2026-91843)
In July 2025, someone registered a domain that used to belong to a content delivery network. The CDN had been wound down years earlier, and the domain it served assets from was allowed to expire. What it had not lost were its callers. Thousands of websites, code repositories, and documentation pages still carry hard-coded references to hostnames beneath it. The new owner holds
A critical vulnerability in Check Point's Security Management and Log Servers could allow an attacker without login credentials to run code as root on those servers over the network. The Security Management Server is the system that controls firewall policy and administrator access. Check Point has released a fix through its LivePatch update channel and says it has no indication that the flaw
Cyberattacks on oil tankers show how connected ships can expose navigation and critical systems, threatening safety, ports and global trade. U.S. Coast Guard personnel and FBI agents boarded two Texas‑bound energy tankers last month after cyberattacks hit the vessels while they were underway, according to U.S. officials. One of the ships was the VL Prosperity, a 1,093‑foot Liberian‑flagged crude oil supertanker headed to Galveston, Texas. Iranian state media identified the ship soon after the incident and claimed hackers gained access to propulsion, navigation and cargo systems, knocking out communications for about 30 hours. “U.S. Coast Guard personnel and FBI agents boarded two Texas-bound energy tankers last month after cyberattacks struck the vessels while they were traveling toward the United States, according to U.S. officials.” CBS News reports. The Coast Guard has not publicly pinned the attacks on Iran. Rear Adm. Amy Grable, commander of U.S. Coast Guard Cyber Command, told CBS News that investigators did find evidence of a malicious cyber actor after assessing the vessel’s IT and other onboard systems. “They started out by doing an assessment of the information technology and the other systems on board the vessel, and they did find malicious cyber activity,” Grable told CBS News. “When these vessels are highly connected, they’re susceptible to cyber threats,” Grable said, warning that an attack could lead to “a vessel blocking a waterway or a pollution incident or any other number of safety and security hazards to our ports and waterways.” The U.S. is still working to determine whether the two cyberattacks are connected and whether Iran or another foreign adversary was behind them. The VL Prosperity, a supertanker carrying about 2.3 million barrels of oil, reportedly suffered a cyberattack on Aug. 7 near the Strait of Gibraltar. The vessel had left Egypt for Galveston and slowed near Gibraltar around the time of the incident. An Iranian report, citing an unnamed crew member, claimed hackers breached the engine room and interfered with cooling, engine speed and fuel systems. Grable said Coast Guard teams had been alerted by interagency partners and went offshore with the FBI to climb aboard, one of roughly 40 to 50 missions the Coast Guard’s Cyber Protection Team has undertaken in the past year. Investigators hunted for malware and combed through IT systems to root out malicious activity, with a particular focus on whether those IT systems were connected to propulsion, navigation and other critical safety systems. Response teams did not find any evidence indicating the ship had become unsafe to navigate when they boarded it. The concern around large cargo vessels and maritime critical infrastructure goes well beyond stolen files or disrupted communications. Modern commercial vessels increasingly run on internet‑connected systems for navigation, propulsion, steering, ballast and other critical machinery, so a cyberattack that penetrates those operational systems could be weaponized or manipulated. Authorities fear the danger of a large vessel being compromised near an American port. “Of course we’re worried about a collision, an explosion, anything that blocks the channel for other vessels to safely enter and exit the port, pollution incidents — we’re kind of worried about the whole gamut,” Grable said. The economic stakes are colossal, with Grable noting that about $5.4 trillion in commerce flows through U.S. ports annually, so even a small disruption can cause major delays. Experts warn that cyberattacks against ships may not require highly advanced skills. Malicious code is already widely available, while AI can help attackers identify vulnerable, internet-facing systems and speed up attacks. In some vessels, satellite internet may be separated from critical systems by little more than a firewall, with navigation, propulsion, steering and ballast sharing the same network. Experts recommend network segmentation, phishing protection and basic cyber hygiene. Cyber access to a ship could create risks similar to remote hijacking, experts warn. However, taking full control of a supertanker is unlikely. A more realistic threat is disrupting critical systems such as navigation or propulsion, potentially making the vessel unsafe or causing it to run aground. Back to the attack on the two oil tankers, the U.S. has not publicly stated who is behind either cyberattack, but Iranian state media began pushing content around the VL Prosperity incident before U.S. authorities even acknowledged the boarding. Four days after Mehr’s initial report, Iran’s Tasnim News Agency published an article with the headline, “No American Vessel Is Safe Anymore: Will Cannons Give Way to Codes?” DuBose stressed that the Iranian narrative remains unverified, cautioning that Iranian‑linked actors are often quick to oversell their cyber influence. Attributing a cyberattack is very complex and can take weeks or even months. Investigators usually study how the attackers operated, looking at their tactics, techniques and procedures, often called TTPs. These patterns can act like digital fingerprints and help connect an attack to known threat groups. The growing concern is that ships are becoming more connected. Satellite communications and links between IT networks and onboard control systems can create new entry points for attackers. Experts say the industry should take this risk seriously, but not assume that every ship can simply be taken over remotely. Because maritime infrastructure is critical, governments are also introducing basic cybersecurity requirements for the sector. For ship owners and operators, the message is simple: pay attention to cybersecurity and strengthen the systems that protect critical onboard operations. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Confirm this action.
Leaving now will discard your changes.