This week brought continued evidence that attackers are targeting the infrastructure organizations trust to secure networks, manage identities, and protect data. Active exploitation of security platform vulnerabilities, evolving phishing techniques, and growing attention to AI governance all featured prominently in the cybersecurity landscape. For business and IT leaders alike, the common thread is the need to maintain visibility into both traditional infrastructure risks and emerging technologies that are becoming part of daily operations.
Check Point Warns of Active Exploitation of VPN Remote Code Execution Vulnerability
Check Point confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution vulnerability affecting Security Gateway and Spark Firewall products that use VPN functionality. The flaw can allow an unauthenticated attacker to execute arbitrary code on vulnerable systems.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, underscoring the seriousness of the issue. Because VPN gateways often sit at the edge of corporate networks, successful exploitation could provide attackers with a direct path into protected environments.
Why it matters:
- The vulnerability is being actively exploited in the wild.
- Affected systems often provide critical remote access functions.
- Edge security infrastructure remains a frequent target for threat actors.
What organizations should consider:
- Confirm whether affected Check Point products are deployed.
- Apply vendor patches and mitigations as soon as practical.
- Review access logs and monitoring data for unusual VPN activity.
Original article:BleepingComputer
Second Check Point Vulnerability Added to CISA’s Known Exploited Vulnerabilities Catalog
Alongside the VPN flaw, CISA added CVE-2026-93616 to the Known Exploited Vulnerabilities catalog. The path traversal vulnerability affects multiple Check Point management products and can allow an unauthenticated attacker to upload and execute arbitrary scripts.
Management servers routinely hold privileged access to security policies, logs, and administrative functions. As a result, successful compromise could provide substantial visibility and control within an environment.
Why it matters:
- Security management infrastructure often contains highly privileged access.
- The vulnerability has reportedly been exploited prior to public disclosure.
- Centralized administration systems can become high-impact targets.
What organizations should consider:
- Identify exposed or internet-accessible management systems.
- Review vendor remediation guidance and patch status.
- Audit administrative access and recent configuration changes.
Original article:CISA Known Exploited Vulnerabilities Catalog
CISA Continues to Expand Focus on Actively Exploited Vulnerabilities
CISA issued multiple updates to the Known Exploited Vulnerabilities catalog throughout the week, continuing its emphasis on prioritizing vulnerabilities that have demonstrated real-world exploitation activity. The growing catalog reflects a broader industry shift toward risk-based patch management rather than severity scores alone.
For organizations with limited resources, exploitation status has become an increasingly valuable factor when deciding where to focus remediation efforts. Many security teams now use KEV listings as a key input for patch prioritization programs.
Why it matters:
- Actively exploited vulnerabilities present a higher likelihood of compromise.
- Risk-based remediation helps organizations focus limited resources.
- Regulatory and cyber insurance expectations increasingly reference exploitability.
What organizations should consider:
- Incorporate KEV monitoring into vulnerability management workflows.
- Align patching priorities with exploitation intelligence.
- Review remediation timelines for internet-facing systems.
Original article:CISA Cybersecurity Advisories
Microsoft Introduces Additional Controls for Enterprise AI Agents
Microsoft highlighted new security and governance capabilities aimed at helping organizations manage AI agents operating across endpoints, cloud environments, and business workflows. The updates focus on visibility, governance, Zero Trust enforcement, and data protection.
As organizations move beyond simple AI assistants toward more autonomous agent-based workflows, security teams face new questions around permissions, oversight, and data exposure. These controls reflect a growing industry effort to establish governance models for AI-enabled business processes.
Why it matters:
- AI agents are gaining access to business applications and workflows.
- Data protection requirements extend to AI-driven processes.
- Governance and visibility remain key concerns for enterprise adoption.
What organizations should consider:
- Review AI governance policies and acceptable-use frameworks.
- Inventory AI tools and agents operating within the environment.
- Evaluate how sensitive information can be accessed and shared by AI systems.
Original article:Microsoft Security Blog
Anthropic Publishes New Report on Malicious Uses of AI
Anthropic released a threat intelligence report detailing cases in which threat actors attempted to use AI systems for cyber operations, fraud, surveillance, and other malicious activities. The report covers activity identified and disrupted over several months.
While many organizations focus on how AI can improve productivity, reports like this provide insight into how threat actors are also experimenting with AI-enabled workflows. The findings help illustrate how defenders and technology providers are adapting alongside changing attacker behavior.
Why it matters:
- Threat actors continue exploring AI-assisted operations.
- Security teams need visibility into emerging tactics and abuse cases.
- AI governance discussions increasingly include misuse prevention.
What organizations should consider:
- Monitor developments in AI-related threat intelligence.
- Maintain security awareness programs that address AI-enabled scams and fraud.
- Evaluate third-party AI usage policies and controls.
Original article:Anthropic Threat Intelligence Report
Device Code Phishing Continues to Evolve Through EvilTokens Platform
Microsoft researchers reported continued activity involving EvilTokens, a phishing-as-a-service platform that facilitates device code phishing attacks. These campaigns focus on stealing authentication tokens rather than traditional passwords, helping attackers bypass some conventional defenses.
Identity systems remain one of the most attractive targets for cybercriminals because successful compromise can provide access to cloud applications, email, and business data. Token theft techniques continue to gain attention as organizations expand cloud-based services and multifactor authentication deployments.
Why it matters:
- Token theft can enable account compromise without password collection.
- Identity remains a primary target for attackers.
- Phishing techniques continue to adapt to modern authentication methods.
What organizations should consider:
- Educate users about device code phishing scenarios.
- Monitor for unusual authentication activity.
- Evaluate conditional access and identity protection controls.
Original article:Microsoft Security Blog