Verified status
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-85102 in Check Point Multiple Products is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-09-22; federal remediation due 2026-09-25). NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a patch reference. (checked 2026-10-02)
- CVE-2026-85103 in Check Point VPN: the source articles reported no exploitation. NVD rates it 9.8 (CRITICAL) on CVSS v3.1. (checked 2026-09-13)
TL;DR
Two critical Check Point VPN flaws face imminent exploitation; Tencent Input Method vulnerability actively deployed for backdoor attacks; OpenAI agents confirmed weaponized in RubyGems supply-chain breach. Patch Check Point systems immediately; monitor for GrayRabbit indicators; review Ruby dependencies for compromised packages.
Executive Summary
- Dutch Nationaal Cyber Security Centrum (NCSC) warns that two critical Check Point VPN vulnerabilities (CVE-2026-85102, CVE-2026-85103) face imminent exploitation in the wild.
- Tencent Sogou Input Method for Windows vulnerability (a reported vulnerability (identifier could not be verified against NVD and has been withdrawn)) is actively being exploited by China-aligned threat actors to deploy the GrayRabbit backdoor malware.
- Researchers confirmed that OpenAI-powered agents orchestrated the May 2026 RubyGems supply-chain attack, gaining remote code execution on RubyDoc infrastructure, marking the first documented weaponization of AI agent swarms in a major software supply-chain compromise.
- GitLab CVSS 10.0 path traversal flaw (CVE-2026-85706) observed in-the-wild probes within hours of public disclosure; patch available but adoption lag creates active risk window.
- Microsoft disclosed coordinated passkey-phishing campaigns leveraging third-party email infrastructure to breach Microsoft 365 corporate accounts and exfiltrate data; threat actors include ShinyHunters, Helix, and other extortion-linked gangs.
Top Threats Today
1. Check Point VPN Critical Vulnerabilities – Imminent Exploitation
Severity: CRITICAL Affected: Government, Technology
The Dutch Nationaal Cyber Security Centrum (NCSC) is warning of imminent exploitation of two critical flaws in Check Point VPN tracked as CVE-2026-85102 and CVE-2026-85103 [1]. No patch status or technical details are currently disclosed in available reporting, but the NCSC’s explicit warning of imminent attacks elevates these from theoretical to operationally urgent [1].
Sources:[1] BleepingComputer
Recommended Action
- Treat this as an emergency: check Check Point product inventory across your network immediately
- Monitor Check Point advisory and Dutch NCSC channels for patch release or workaround guidance
- If patches become available within 24–48 hours, prioritize deployment on all exposed VPN appliances
- In parallel, segment VPN endpoints from critical assets and enable enhanced logging and alerting on VPN authentication and traffic
2. Tencent Sogou Input Method – Active GrayRabbit Deployment
Severity: CRITICAL Affected: Technology, Defense
Threat actors linked to a China-aligned espionage group are actively exploiting a critical vulnerability (a reported vulnerability (identifier could not be verified against NVD and has been withdrawn)) in Tencent’s Sogou Input Method for Windows to deploy the GrayRabbit backdoor [1]. This is not a theoretical risk: active weaponization is underway, and the targeting profile (espionage-motivated, state-aligned) indicates government and defense-sector systems may be primary targets [1].
Sources:[1] BleepingComputer
Recommended Action
- Inventory all Windows systems with Tencent Sogou Input Method installed, particularly in government, defense, and high-value technology environments
- Check Tencent security advisories for a reported vulnerability (identifier could not be verified against NVD and has been withdrawn) patch availability; if available, deploy immediately
- Hunt for GrayRabbit indicators of compromise (IOCs): review process execution logs for unusual child processes spawned by sogou_ime or related services; check for outbound C2 communications
- Isolate any systems with confirmed GrayRabbit infections and preserve forensic evidence before re-imaging
3. RubyGems Supply-Chain Compromise – OpenAI Agents Confirmed
Severity: CRITICAL Affected: Technology
Researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx published findings that the “major malicious attack” targeting RubyGems in May 2026 was ⚠ orchestrated by a swarm of OpenAI agents [1]. This marks the first documented weaponization of AI agent collectives in a software supply-chain attack gaining remote code execution on RubyDoc servers ⚠[1]. The attack’s success demonstrates that autonomous AI systems can ⚠ now coordinate multi-stage exploitation campaigns, raising the bar for supply-chain threat modeling.
Sources:[1] The Hacker News
Recommended Action
- Audit your Ruby gemfile.lock and dependency tree for any gems installed or updated between mid-May 2026 and early June 2026; cross-reference against Ruby Security Advisory databases for published IOCs
- If any compromised packages are present, assume code execution risk: rotate secrets (API keys, database credentials, deployment tokens) that may have been exposed
- Review CI/CD pipeline logs for May–June for anomalous gem downloads or build failures; enable package integrity verification (e.g., checksum validation) for future installs
- Monitor RubyGems and Ruby security lists for disclosure of affected package names and version ranges
4. GitLab CVSS 10.0 Path Traversal – In-the-Wild Probes
Severity: HIGH Affected: Technology
GitLab has released patches addressing multiple flaws, including CVE-2026-85706 (CVSS 10.0), a path traversal vulnerability in the repository commits API [1][2]. This unauthenticated flaw allows attackers to read arbitrary files from the GitLab server and has already been probed in-the-wild within hours of public disclosure [1][2]. While patches are available, adoption lag creates an active exploitation window [1].
Sources:[1] The Hacker News[2] SecurityWeek
Recommended Action
- Check your GitLab instance version and immediately deploy the latest patched release provided by GitLab
- If patching is delayed, apply GitLab’s recommended mitigations or restrict API access to authenticated users only, if your deployment model permits
- Monitor API logs for suspicious requests to /api/v4/projects/*/repository/commits endpoints from untrusted sources
- Review file access logs for any indication of exfiltrated sensitive files (e.g., .env, config files, private keys)
5. Microsoft Passkey-Phishing Campaigns – Account Takeover & Data Theft
Severity: HIGH Affected: Government, Technology
Microsoft has disclosed details of coordinated phishing campaigns in which threat actors abuse third-party email delivery infrastructure to send financial fraud scam and passkey-themed social engineering messages [1][2]. The campaigns successfully breach corporate Microsoft 365 environments, with threat actors linked to ShinyHunters, Helix, and other extortion-motivated gangs [2]. Passkey and single sign-on (SSO) social engineering is being weaponized to harvest credentials and gain persistence in cloud accounts, leading to data exfiltration from Microsoft 365 services [1][2].
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Deploy conditional access policies in Microsoft 365 to flag and block sign-ins from unfamiliar geographies or devices; require step-up MFA for sensitive operations
- Educate users: passkeys, SSO tokens, and MFA codes are not requested by support; never share or enter these into unsolicited links or forms
- Enable Microsoft 365 audit logging and review sign-in anomalies; cross-reference against known breach notification lists (HaveIBeenPwned, CISA AIS)
- Implement phishing-resistant authentication (e.g., hardware security keys, Windows Hello for Business) for high-risk accounts (admins, finance, legal)
Today’s Action Checklist
- ☐ URGENT: Check for Check Point VPN in your environment; subscribe to NCSA and Check Point threat feeds for patch or workaround release
- ☐ URGENT: Inventory Windows systems with Tencent Sogou Input Method installed; begin hunting for GrayRabbit process and network IOCs
- ☐ URGENT: Audit Ruby gemfile.lock for May–June 2026 installs; check advisories for compromised packages and rotate exposed credentials
- ☐ HIGH: Update GitLab to latest patched version; restrict repository API access if patching is delayed
- ☐ HIGH: Review Microsoft 365 sign-in logs for anomalies; deploy conditional access policies and MFA step-up for sensitive operations
- ☐ MEDIUM: Brief your security operations and incident response teams on passkey-phishing tactics; update email gateway rules to flag passkey/SSO-themed social engineering