Verified status
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-69730 in Microsoft Windows: the source articles reported no exploitation. NVD rates it 9.8 (CRITICAL) on CVSS v3.1. (checked 2026-09-17)
- CVE-2026-69829 in Microsoft Windows: the source articles reported no exploitation. NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a patch reference. (checked 2026-09-18)
- CVE-2026-81963 in Microsoft Windows is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-09-08; federal remediation due 2026-09-22). NVD rates it 7.8 (HIGH) on CVSS v3.1. NVD lists a patch reference. (checked 2026-09-18)
- CVE-2026-85880 in Microsoft Windows is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-09-08; federal remediation due 2026-09-22). NVD rates it 7.8 (HIGH) on CVSS v3.1. NVD lists a patch reference. (checked 2026-09-18)
TL;DR
Microsoft patched 974 vulnerabilities in its largest single security update ever [12]. Check Point Security Management servers face unauthenticated RCE attacks [1]. Docker Sandboxes on macOS can be escaped by malicious guest code to access host files [3].
Executive Summary
- Microsoft released its largest patch batch on record, addressing 974 security holes across Windows and enterprise software.
- Check Point Security Management and Log Servers face critical unauthenticated remote code execution that could compromise firewall policy control.
- Docker Sandboxes on macOS contain a sandbox escape allowing malicious containers to read and modify arbitrary host files.
- New Android malware RatHat uses AI-powered automation to remotely control compromised devices.
- Brevo supply-chain attack injected malicious ClickFix scripts on customer sites after stealing a Cloudflare API key.
Top Threats Today
1. Microsoft Patches Record 974 Vulnerabilities in Single Batch
Severity: HIGH Affected: Technology
Microsoft issued updates to plug at least 974 security holes in Windows operating systems and other software, marking the company's largest single patch batch ever [1]. The company reports that artificial intelligence is helping accelerate vulnerability discovery [1].
Sources:[1] Krebs on Security
Recommended Action
- Prioritize Windows systems for immediate patching, especially in high-risk environments (government, finance, healthcare)
- Use CVSS scores and Microsoft's Security Update Guide to triage patches by criticality and deployed product versions
- Test patches in non-production environments before enterprise rollout
2. Check Point Security Management Server Unauthenticated RCE
Severity: CRITICAL Affected: Technology
A critical vulnerability in Check Point's Security Management and Log Servers allows an attacker without login credentials to execute code as root on those servers over the network [1]. The Security Management Server is the system controlling firewall policy and administrator access [1].
Sources:[1] The Hacker News
Recommended Action
- Immediately check for Check Point Security Management server instances exposed to untrusted networks
- Apply Check Point's security updates and restrict network access to management interfaces
- Monitor for unauthorized administrative activity on affected systems
3. Docker Sandboxes Sandbox Escape on macOS Allows Host File Access
Severity: HIGH Affected: Technology
Malicious code running inside a Docker Sandboxes virtual machine on macOS could escape the shared project directory and read or modify files anywhere else on the host [1]. The escape runs with the rights of the host account [1].
Sources:[1] The Hacker News
Recommended Action
- Update Docker Sandboxes to the latest patched version immediately
- Restrict the use of untrusted container images on macOS systems until patched
- Review container file-sharing configurations and disable unnecessary shared volumes
4. RatHat Android Malware with AI-Powered Device Control
Severity: HIGH Affected: Technology
A new Android malware called RatHat has been discovered that uses an AI-powered subsystem to help operators remotely navigate and control compromised devices [1].
Sources:[1] BleepingComputer
Recommended Action
- Review mobile device management (MDM) policies to detect suspicious remote control activity
- Educate users on risks of installing apps from untrusted sources
- Enable Google an unattributed threat actor Protect and keep Android security patches current ⚠
5. Brevo Supply-Chain Attack Injects ClickFix Malware via Stolen Cloudflare Key
Severity: HIGH Affected: Technology
Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites to distribute malware [1].
Sources:[1] BleepingComputer
Recommended Action
- Audit all third-party JavaScript and external scripts loaded on customer-facing websites
- Rotate all API keys and credentials with elevated access; enforce strong API key management and regular rotation
- Monitor customer site traffic for ClickFix indicators and malware distribution patterns
Today’s Action Checklist
- ☐ URGENT: Inventory Check Point Security Management servers and block untrusted network access until patched
- ☐ URGENT: Initiate Microsoft patch deployment for critical Windows and enterprise software vulnerabilities
- ☐ HIGH: Update Docker Sandboxes installations on macOS to latest patched version
- ☐ HIGH: Scan for RatHat Android malware indicators on corporate-managed mobile devices
- ☐ HIGH: Audit API key access logs and rotate all Cloudflare and critical platform credentials