TL;DR
Check Point VPN gateway RCE actively exploited; MikroTik routers compromised via chained SSH flaws; malicious Terraform and npm packages distribute Go malware. Windows, GitLab, and supply chains under immediate threat.
Executive Summary
- Check Point Security Gateway VPN vulnerability (CVE-2026-85102) is being actively exploited in the wild to gain remote code execution on network perimeters.
- MikroTik RouterOS SSH vulnerabilities chained together (MikroTrick, CVE-2026-67279) allow unauthenticated takeover of internet-exposed routers without passwords or SSH keys.
- Threat actors are distributing Go-based malware via legitimate package repositories—HashiCorp Terraform providers, npm, and PyPI—marking a significant shift in supply-chain attack vectors.
- GitLab issue email addresses contain embedded credential tokens that enable arbitrary code commits and CI/CD job execution when exposed.
- A new Windows malware (CLOSEDQUORUM) uses AI model voting to decide which credentials and wallet data to steal, representing an evolution in adversarial decision-making.
Top Threats Today
1. Check Point Security Gateway VPN RCE Under Active Exploitation
Severity: CRITICAL Affected: Government Finance
Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution vulnerability in the VPN certificate-handling functionality of its Security Gateway and Spark Firewall products [1][2]. The vulnerability allows unauthenticated remote attackers to execute arbitrary code on affected gateways [2]. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on September 22, 2026, with a federal remediation deadline of September 25 [2].
Sources:[1] BleepingComputer[2] CISA KEV
Recommended Action
- Apply available patches to Check Point Security Gateway and Spark Firewall immediately; consult vendor advisory for version-specific guidance.
- Prioritize patching systems exposed directly to the internet or untrusted networks.
- Monitor VPN gateway logs for suspicious certificate-validation failures or unexpected remote connections.
- Consider temporary network segmentation or access controls on VPN endpoints pending patch deployment.
2. MikroTik RouterOS SSH Chain Enables Passwordless Takeover
Severity: HIGH Affected: Telecom Government
Researchers have disclosed MikroTrick, a vulnerability chain combining two SSH flaws in MikroTik RouterOS that allows attackers to take full administrative control of internet-exposed routers without a password, SSH key, or completed authentication [1]. CERT Polska identified the chain, with CVE-2026-67279 serving as a component of the attack [1]. No details on patch availability were provided in available reporting.
Sources:[1] The Hacker News
Recommended Action
- Audit and inventory all MikroTik RouterOS deployments, especially those exposed to the internet.
- Restrict SSH access to trusted IP ranges or disable remote management where possible.
- Monitor RouterOS logs for unexpected authentication attempts or privilege escalations.
- Check with MikroTik for patched firmware versions and apply as soon as available.
3. Malicious Packages Across HashiCorp, npm, and PyPI Deliver Go Malware
Severity: HIGH Affected: Technology
Threat actors have compromised or created malicious packages across multiple major package repositories, distributing Go-based malware [1][2]. Two malicious Terraform providers and Go modules were found in the HashiCorp-hosted registry, marking the first known use of the centralized Terraform repository as a malware distribution vector [1]. Separately, unknown threat actors compromised two legitimate MemTensor packages on npm and PyPI with a platform-specific credential stealer called sckit targeting Windows, Linux, and macOS systems [2].
Sources:[1] The Hacker News[2] The Hacker News
Recommended Action
- Audit package dependencies in Terraform code, npm projects, and Python environments for unexpected or recently updated packages.
- Review dependency lock files and pinned versions; enable reproducible builds to detect supply-chain tampering.
- Establish policy to verify package integrity (checksums, GPG signatures) before deployment.
- Enable Software Composition Analysis (SCA) tooling to flag suspicious or newly published packages with high privileges.
4. GitLab Issue Email Credentials Enable Code Injection and CI/CD Hijacking
Severity: HIGH Affected: Technology
GitLab assigns private email addresses to each user for filing issues by email, but these addresses function as embedded credential tokens [1][2]. If exposed, an attacker can email patches that GitLab commits in the victim’s name to any branch the user can push to, including main branches, and can trigger CI/CD jobs that execute with the victim’s privileges [1]. This represents a significant supply-chain and privilege-escalation risk for development teams [2].
Sources:[1] The Hacker News[2] Dark Reading
Recommended Action
- Educate developers to treat GitLab issue email addresses as sensitive credentials; do not publish them in code, documentation, or public repositories.
- Rotate GitLab issue email addresses for any users whose addresses may have been exposed or shared externally.
- Implement branch protection rules requiring code review and approvals before merges to main and release branches.
- Enable audit logging and alerting on CI/CD job executions triggered by email-based commits.
- Consider disabling email-based issue filing for users working on security-sensitive projects.
5. CLOSEDQUORUM Windows Malware Uses AI Model Voting for Theft Decisions
Severity: HIGH Affected: Finance
Cisco Talos has disclosed a Windows malware called CLOSEDQUORUM designed to take orders from a vote of up to four AI models instead of a centralized attacker server, ⚠ according to reporting on September 22 [1]. The models can independently decide to steal Windows credentials, saved browser passwords, and cryptocurrency wallet data [1]. Talos has not observed this malware in active campaigns to date, but the architecture represents a novel evasion and resilience technique [1].
Sources:[1] The Hacker News
Recommended Action
- Deploy or update endpoint detection and response (EDR) tools with behavioral monitoring for credential-dumping and wallet-access activities.
- Enable Windows Credential Guard on Windows 10/11 systems to protect cached credentials from theft.
- Audit browser-stored credentials and encourage the use of password managers with restricted export.
- Monitor for unusual outbound connections or API calls to AI model endpoints from compromised endpoints.
Ongoing Coverage
- WordPress CVE-2026-87902: BleepingComputer reports threat actors have moved from probing to [exploitation unverified], writing files to disk that execute shell commands [9]. See earlier coverage.
- Adobe Critical Patches: SecurityWeek reports Adobe patched nine critical flaws in Connect and AEM Forms products (CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, CVE-2026-75698, CVE-2026-75745, CVE-2026-81995) for arbitrary code execution and privilege escalation [29].
- Credential Stealer via Placeholder Domain: BleepingComputer reports the commonly-used documentation placeholder domain “third-party.com” is now serving a fake Cloudflare verification page designed to trick Windows users into executing malicious PowerShell commands [6].
- RemControl Android Banking Malware: A new Android malware-as-a-service platform called RemControl is targeting European and Canadian users through malvertising campaigns impersonating the TVTap IPTV application [7].
- AI Agents Steal 600K Credit Cards: BleepingComputer reports a financially motivated threat actor is using open-source AI agent frameworks to attack hundreds of online retailers at scale, stealing more than 600,000 credit card records and infecting 100+ sites with skimmers [10].
Today’s Action Checklist
- ☐ URGENT: Apply patches for Check Point Security Gateway CVE-2026-85102; prioritize externally-exposed VPN endpoints. Deadline: September 25, 2026.
- ☐ URGENT: Audit MikroTik RouterOS deployments for internet exposure; restrict SSH access and monitor for authentication anomalies pending patch release.
- ☐ HIGH: Scan npm, PyPI, and Terraform dependency trees for suspicious or newly added packages; enable Software Composition Analysis.
- ☐ HIGH: Audit code repositories and wikis for exposed GitLab issue email addresses; rotate credentials if any addresses were shared or published.
- ☐ MEDIUM: Review EDR tuning to detect credential-theft behaviors associated with CLOSEDQUORUM and similar AI-augmented malware.
- ☐ MEDIUM: Deploy patches for Adobe Connect and AEM Forms (eight CVEs) in non-production environments this week; schedule production rollout within 30 days.