Security Analyst: 2026-09-25
23 minutes in total
Check Point, 2026-09-22. Read, 3 min.
Check Point reports a wave of exploitation attempts since September 12 against Spark customers using CVE-2026-85102, a pre-authentication remote code execution flaw in Security Gateway VPN certificate handling that it fixed on September 9. Separately, it identified a handful of pinpointed attacks on July 23, 2026 exploiting CVE-2026-93616, a newly discovered pre-authentication path traversal in the Security Management web service, and made a fix available with this advisory.
Why it matters for this role: A certificate-based Mobile Access login from VPN or proxy infrastructure now deserves a second look, and Check Point says follow-up activity often includes internal port and service scans.
One URL, Three Different Tricks
SANS Internet Storm Center, 2026-09-24. Read, 3 min.
SANS Internet Storm Center handler Xavier Mertens examined a phishing link that combines a random userinfo string before an @, a hostname label ending in hyphens on a lookalike domain, and the recipient's email address appended to the path. A naive filter sees email addresses or a link to the recipient's own domain, a strict validator may drop the link as an invalid hostname, and the browser follows a valid URL to the phishing page.
Why it matters for this role: A link that seems to point at your own domain can still land on a phishing page, because a parser that splits on the last @ reads the recipient's address as the host.
Disrupting EvilTokens: The AI Chatbot Built for Cybercrime
Microsoft, 2026-09-22. Read, 6 min.
Microsoft's Digital Crimes Unit, with Health-ISAC as co-plaintiff and authorization from a US federal court, disrupted EvilTokens, a cybercrime service linked to more than 12,000 compromised inboxes across over 10,000 organizations since it launched in February 2026, seizing 50 websites and disabling more than 150 domains. EvilTokens tricked victims into entering an authentication code on Microsoft's legitimate sign-in page, and the Metropolitan Police Service in the United Kingdom arrested two men on suspicion of offenses connected with it.
Why it matters for this role: When an account shows signs of device code phishing, a password reset alone may leave the attacker inside, which puts session and token revocation on your checklist.
Spraying in the Andes: TeamFiltration Returns to Exploit Forgotten Service Accounts
Proofpoint, 2026-09-22. Read, 7 min.
Proofpoint identified a TeamFiltration campaign it tracks as UNK_CondorFiltration that targeted over 5,700 accounts across 28 Microsoft 365 tenants in Latin America, focusing on Chilean organizations. All seven accounts it compromised were unmanaged functional or service accounts with no prior legitimate login baseline and no MFA enforcement, which Proofpoint says strongly indicates default or predictable passwords that were never rotated.
Why it matters for this role: Prioritize sign-in alerts on Microsoft 365 service accounts that have no legitimate login history, since every account this spray campaign compromised was one of them.
AL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660
Canadian Centre for Cyber Security, 2026-09-24. Read, 4 min.
The Canadian Centre for Cyber Security says it is aware of active exploitation of CVE-2026-65660, a code injection flaw that could let an authenticated attacker execute code on SharePoint Server and that, chained with other SharePoint vulnerabilities, can achieve pre-authentication remote code execution on servers configured to permit anonymous access. The alert lists fixed builds for SharePoint Server 2016, 2019, and Subscription Edition, and notes that 2016 and 2019 reached end of life on July 15, 2026.
Why it matters for this role: The alert's monitoring list, from unexpected web part changes to access to IIS machine keys, gives you concrete things to check on SharePoint servers that were exposed before patching.
The quiz for this edition has closed.