IT News Analysis

1

Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root

A critical vulnerability in Check Point's Security Management and Log Servers could allow an attacker without login credentials to run code as root on those servers over the network. The Security Management Server is the system that controls firewall policy and administrator access. Check Point has released a fix through its LivePatch update channel and says it has no indication that the flaw has been exploited. Check Point told The Hacker News that the vulnerable path runs only through the Trusted Clients setting, which controls which hosts may connect to the management server through SmartConsole. The flaw, tracked as CVE-2026-91843 and rated 9.8 out of 10 on the CVSS scale by Check Point, is a stack overflow in the login process, which handles requests before a user is authenticated. Internet scanning company Censys said the overflow is triggered by a login request that carries a very long username. Check Point said in a notice on its  CheckMates community  on...

Sep 17, 2026

2

AI Security's Greatest Hits

Get 7 of the most widely used AI security resources in one pack. Each asset provides practical tools for securing AI apps, models, and agents.

3

ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories

Attackers keep finding new keys. The funny part is that defenders keep inventing where to store them. This week, those keys sit in AI tools, exposed services, old bugs, weak logins, and software sold like a monthly subscription. Some attacks use new tricks. Others just reuse what was already lying around. Both work often enough. So the threat landscape is not getting cleaner. It is just getting more places to make the same mistake. Here’s what showed up this week. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.

Sep 17, 2026

4

Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files

Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the project directory shared into it and read or change files anywhere else on the host, Docker warns in a  security announcement  on September 15. The escape runs with the rights of the host account that runs the virtual machine. The flaw,  CVE-2026-77179 , is rated Critical, affects versions 0.28.0 up to but not including 0.42.0 on macOS, and was fixed in  0.42.0  on September 7. Docker Sandboxes runs each AI coding agent in its own small virtual machine with the project directory shared in. The code that could escape is whatever runs inside that machine, such as a coding agent that has been turned against its user, or anything malicious the agent installs and runs. Docker has not reported any exploitation. CISA's added assessment on the CVE record lists exploitation as none, and the flaw is not in CISA's Known Exploited Vulnerabilities catalog as of the ca...

Sep 17, 2026

5

Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords

The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE . "HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading, file cleanup, and persistence via Windows autorun registry keys," Group-IB said . On the other hand, CRUDEEXCLUDE is a Delphi-based Windows utility employed to prepare environments for the deployment of subsequent stages such as HEAVYGRAM. First observed in late July 2024, the malware is often disguised as a legitimate application with a graphical user interface (GUI), and configures Microsoft Defender exclusion paths for defense evasion. The findings build upon an alert the U.S. Federal Bureau of Investigation (FBI) first issued in March 2026 and again earlier this wee...

Sep 17, 2026

6

Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone

Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an  advisory  on Wednesday. An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution. Unbound 1.26.1, released the same day, fixes the bug, tracked as  CVE-2026-81642 , along with eight other flaws. One of the eight,  CVE-2026-82717 , is a heap corruption bug in CNAME synthesis reported by Ben Morris of Anthropic. It could also lead to remote code execution "under certain systems and compilation options," NLnet Labs said. NLnet Labs has not reported exploitation of either bug, and CISA's entry for CVE-2026-81642 marked exploitation as "none" on Wednesday. NLnet Labs rates the DNSKEY flaw Critical, with a CVSS score of 4.0 (9.1), and its scoring lists a network attack vector requiring no privileges or user interaction. NVD listed the CVE as "Await...

Sep 17, 2026

7

Free Assessment: Identify Hidden Internal Risk

Discover unnecessary user access to risky tools, shadow IT, based on real user behavior.

8

Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar

A new CVE drops. Your scanner finds it. The severity score looks ugly. But that still does not answer the question that matters: Can it actually be exploited in your environment? Mythos-class AI is compressing the time between disclosure and working exploitation, while many security programs still validate risk on weekly or quarterly cycles. The dangerous gap is no longer just technical. It is measured in time. 📅 Save Your Spot Today: How to Prove You're Ready for Mythos-Class Attacks . Can’t join live? Register anyway. We’ll send the webinar recording after the session, so you can watch it later, whenever it fits your schedule, and still see the full, fresh CVE-to-validation workflow. Stop prioritizing on severity alone A high score tells you a vulnerability could be serious. It does not prove that an attacker can use it against you. Security teams need faster answers: Is the affected asset exposed? What attack techniques does exploitation require? Do ...

Sep 17, 2026

9

CISO's Expert Guide to Agentic Pentesting for Websites

Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days to patch one (Verizon DBIR 2026). A new free guide explains how autonomous AI agents are closing that gap, and what security leaders must demand before pointing one at production. TL;DR Exploitation is now the front door. It starts 31% of breaches (Verizon DBIR 2026), the #1 initial-access vector, while annual pentesting leaves an estimated 90% of the estate untested. The capability is proven, not projected. An autonomous system topped HackerOne's US leaderboard in 2025 (XBOW), and peer-reviewed agents exploited 87% of one-day flaws unaided (Fang et al., 2024). Continuous beats periodic, measurably. Programmatic testing makes teams 4.5x more likely to fix criticals within three days (Cobalt, 2026). It's an AI agent in your production. Hold it to a bar. Provable coverage, an independent validator, blast-radius guardrails, and a...

Sep 17, 2026

10

China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America

The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025. "SparroWocky is a modular, C++ backdoor," ESET security researchers Alexandre Côté Cyr and Romain Dumont said in a technical report shared with The Hacker News ahead of publication. "Its architecture and the techniques used by its authors indicate strong knowledge of anti-analysis tricks and Windows internals." SparroWocky is so named for the fact that early iterations of the malware have been found to contain the first stanza of Jabberwocky , a famous nonsense poem written by the English author, poet, and mathematician Lewis Carroll in around 1855. The latest findings from ESET indicate that the cyber espionage group , which shares some level of overlap with Earth Estries and Salt Typhoon, has replaced SparrowDoor with Spar...

Sep 17, 2026