Check Point Gateways Under Attack: Hunting PHP2Shell and CVE-2026-123039

Attackers chained PHP2Shell with Check Point CVE-2026-123039 to get root, plant backdoors and wipe ESXi. How to patch, mitigate and hunt on Gaia today.

Barracuda ESG Root Chain: A Forged Backup Hands Over Your Email Gateway

Barracuda ESG CVE-2026-116606 and CVE-2026-111560 chain to pre-auth root and are exploited in the wild. Who is affected, how to check, patch and hunt.

AI Hackers Are Here: What Operation Snowball Means for Business

An AI agent hacked a telecom for two weeks, stolen AI keys ran up $740K, and Pakistan's NCERT warns banks. What it means for your business and what to do now.

Outlook Zero-Day CVE-2026-124194: One Email, One Leaked Password Hash

Outlook zero-day CVE-2026-124194 leaks NTLMv2 hashes from a crafted message and is in CISA KEV. Who is affected, fixed builds, detection queries and mitigations.

Plex2Shell: Why QNAP Says Your Media Server May Already Be Compromised

Plex2Shell chains four Plex Media Server CVEs into code execution on QNAP and Synology NAS. Who is affected, how to check for compromise and how to clean up.

SSHole: The OpenSSH Bug That Turns "No Password" Into Root

OpenSSH CVE-2026-123158 (SSHole) lets attackers log in to passwordless accounts on Alpine and other musl systems. Who is affected, detection and fixes.

SonicWall SSL VPN SAML MFA Bypass: A Hunt and Harden Guide

CVE-2026-19868 lets SonicWall SSL VPN users skip SAML and MFA and is in CISA KEV. How to check exposure, patch, and hunt for logins your IdP never saw.

Hacked Freezers: What the Cold-Chain Attacks Mean and What to Do

Attackers hijacked refrigeration controllers across Europe, and FBI and CISA now warn cold-chain operators. What happened, who is at risk and a hardening checklist.

Poisoned Trackers: What APT29's Plerdy Hijack Means for Your Business

APT29 hijacked the Plerdy SEO tracker to attack site visitors' phones. What it means for businesses, and a plan to control third-party scripts and devices.

cPGuard Update Hijack: What Hosting Teams Must Do Now

Attackers pushed a fake cPGuard update that stole /etc/shadow, SSH keys and DB credentials from ~2,950 servers. Who is affected, IOCs and a recovery checklist.

Node-RED Under Attack: Find, Lock Down and Hunt CVE-2026-58115

CVE-2026-58115 is being exploited to plant bots and web shells via exposed Node-RED editors. How to find them, enable adminAuth and hunt for malicious flows.