60
60
60
60
60
60
60
60
60
60
60
45
14th September – Threat Intelligence Report
Check Point weekly digest: Microsoft's record 974-vuln Patch Tuesday ships two actively exploited Windows zero-days; IDScan.net, Mathspace, Revolut suffer breaches.
Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities, including two actively exploited privilege-escalation zero-days, CVE-2026-85880 and CVE-2026-81963, plus 20 flaws allowing unauthenticated remote code execution. Disclosed breaches include IDScan.net (identity documents), Mathspace (over 1 million people via Metabase CVE-2026-72898), Revolut, and Florida DMV (ShinyHunters). GitLab fixed critical CVSS 10.0 path traversal CVE-2026-85706, and MikroTik fixed chainable RouterOS flaws CVE-2026-67276 and CVE-2026-86060. The report also covers the PuzzleMask LLM jailbreak technique, GoldFactory's Gigabud Android fraud, and the BlueMoon Chromium exploit chain (CVE-2026-85046).
78
PaperCut warns of hackers using printer management software flaw in attacks
PaperCut warns of active exploitation of CVE-2026-82078 and CVE-2026-81578 in NG/MF print management software used by universities, corporations, and governments.
PaperCut issued an emergency advisory saying vulnerabilities in PaperCut NG and MF, tracked as CVE-2026-82078 and CVE-2026-81578 with severity scores above 8.8, are under active exploitation with confirmed customer incidents. Huntress reported at least two customers impacted, and an initial patch was revised with input from Huntress and watchTowr researchers. PaperCut software is widely deployed at universities, corporations, and governments managing printers from Canon, Epson, Xerox, and Brother, and the vendor urged removing server web interfaces from the public internet. Previous PaperCut flaws were used by ransomware gangs like Bl00dy and Clop, and CISA has warned the education sector is particularly exposed.
78
CISA gives federal agencies two weeks to patch Microsoft bug exploited in DPRK campaign
CISA orders federal agencies to patch exploited Windows Winsock zero-day CVE-2026-68820 by August 25, used by Lazarus in Operation Dream Job.
CISA ordered federal agencies to patch Windows Winsock vulnerability CVE-2026-68820, rated 7/10, by August 25 after confirming exploitation; no workaround exists and a restart is required. Check Point found Lazarus Group hackers impersonated Lockheed Martin and Enveil recruiters on LinkedIn, sent malicious PDFs enabling long-term remote access, then used the zero-day to escalate from limited access to full system control. Targets spanned defense sectors including surveillance, drones and robotics in France, Germany, Brazil and India, as part of Operation Dream Job tracked since 2020.
82
60
60
60
45
60
60
60
Week in review: Axios npm supply chain compromise, critical FortiClient EMS bugs exploited
60
60
60
60
Week in review: Firmware-level Android backdoor found on tablets, Dell zero-day exploited since 2024
60
60
60
60
60
60
60
60
60
60
60
60
60
60