Thursday, September 24, 2026
Daily digest
Multiple network-edge and CI/CD platforms are under active exploitation today — F5 BIG-IP APM, Check Point Security Gateway VPN, and JetBrains TeamCity all have confirmed in-the-wild attacks. If you run any of these, patching should be top priority this week.
Critical F5 BIG-IP APM Zero-Day Under Active Attack
A critical zero-day remote code execution vulnerability in F5 BIG-IP APM is being actively exploited in the wild. F5 has released a patch, and both CISA and F5 are urging immediate remediation.
Why it matters: If BIG-IP APM is used for remote access into your environment, this is a CUI-exposure risk — patch immediately and treat as a CMMC-relevant incident if unpatched systems were internet-facing.
Check Point Confirms Active Exploitation of VPN Gateway RCE
Check Point confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution flaw in the VPN certificate-handling function of its Security Gateway product. The vendor has issued guidance and a fix.
Why it matters: Pre-auth RCE on a VPN gateway is a direct path into internal networks; if Check Point gateways sit at your perimeter, patch now and audit VPN logs for signs of exploitation.
CISA Warns Ransomware Gangs Now Exploiting Critical TeamCity Flaw
CISA alerted federal agencies that ransomware groups are actively exploiting a critical JetBrains TeamCity vulnerability that was patched in July. The agency added the flaw to its known-exploited list.
Why it matters: If TeamCity is part of your CI/CD pipeline, confirm the July patch was applied — ransomware groups pivoting to build servers is a direct threat to software supply-chain integrity under NIST 800-171 requirements.
TeamFiltration Campaign Compromises Microsoft 365 Accounts via Default Passwords
The UNK_CondorFiltration campaign targeted over 5,700 accounts across 28 Microsoft 365 tenants, compromising 7 accounts using default/weak passwords. Proofpoint traced the activity to 1,487 unique AWS EC2 source IPs, primarily targeting Chilean retail and financial institutions.
Why it matters: Directly relevant to M365 GCC High tenants — verify Conditional Access policies block sign-ins from anomalous cloud-hosted IP ranges and confirm no accounts still use default or weak passwords.
Exploit Released for Unpatched Ubuntu Container Escape Flaw
A use-after-free vulnerability in the Linux kernel's AF_UNIX socket subsystem, tracked as CVE-2026-80521, allows container escape to host root. It was fixed upstream on August 6, but Ubuntu has not shipped the patch for its 26.04, 24.04, or 22.04 LTS releases, and a public exploit is now available.
Why it matters: If any Ubuntu-based container workloads run on your Nutanix AHV cluster, this is an unpatched host-compromise risk with a public exploit — consider kernel mitigations or workload isolation until Ubuntu ships a fix.
Malicious Terraform Providers Used to Distribute Go Malware via HashiCorp Registry
Researchers disclosed Go-based malware distributed through two Go Modules and two Terraform providers hosted on the HashiCorp registry, marking the first known use of that centralized repository as a malware distribution vector. The malicious packages had accumulated hundreds of downloads before discovery.
Why it matters: If your automation pipeline pulls Terraform providers or Go modules, audit sources and pin versions — this establishes a new supply-chain vector for infrastructure-as-code tooling.
Leaked GitLab Issue Email Address Can Be Weaponized for Supply Chain Attacks
GitLab's per-project incoming email address for filing issues functions as a privileged credential — anyone who obtains it can email a patch that GitLab commits as the victim user, including to protected branches, and can trigger CI/CD jobs running as that user.
Why it matters: If GitLab is used anywhere in your dev or automation pipeline, treat these issue-email addresses as secrets and rotate/restrict them — leakage enables code injection and CI job execution under a victim's identity.
Stolen FBI Data Reveals Employees' Intelligence and Surveillance Roles
Data allegedly stolen from an FBI jobs website reveals the roles of analysts working on China, Russia, and electronic surveillance programs. The hacking group ShinyHunters claimed responsibility, and the FBI confirmed it is investigating but has not identified the point of breach.
Why it matters: Continued high-profile breaches of federal personnel data underscore the scrutiny defense contractors face over insider-threat and personnel-data protection controls required under NIST 800-171/CMMC L2.
GenAI.mil Draws 2 Million Users in a Week as DoD Pushes AI Adoption
DoD Chief Digital and AI Officer Cameron Stanley said the department's GenAI.mil platform saw more than 2 million users in one week. Stanley also said 'unilateral disarmament is the wrong approach' regarding calls to slow AI development.
Why it matters: Signals accelerating DoD AI adoption and likely future contractual expectations around contractor AI capability and governance — worth tracking for self-hosted AI stack alignment with emerging DoD guidance.
VA Previews Timeline for Enterprise AI Services Competition
The Department of Veterans Affairs outlined a timeline for a final solicitation on a three-year enterprise AI services contract that will roll out AI capabilities to 540,000 users.
Why it matters: A large-scale federal enterprise AI rollout will likely set precedent for security and compliance requirements (FedRAMP, CMMC-adjacent controls) that other agencies and contractors may be measured against.
Microsoft Announces ISOC to Unify SIEM and Threat Protection in Defender
Microsoft announced ISOC (Integrated Security Operations Center) in Microsoft Defender, combining SIEM and threat protection capabilities into a single foundation designed for agentic security operations.
Why it matters: Relevant to any M365 GCC High tenant using Defender/Sentinel — evaluate how ISOC changes licensing, data residency, and SOC workflow before adopting agentic features in a CMMC-regulated environment.
MikroTrick SSH Chain Lets Attackers Take Over MikroTik Routers Without Authentication
CERT Polska disclosed a chained exploit called MikroTrick combining an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug (CVE-2026-86060) in RouterOS, allowing full administrative takeover of internet-exposed MikroTik routers without a password, SSH key, or completed authentication. Attack logs date back further than the disclosure.
Why it matters: Any internet-exposed MikroTik RouterOS devices in your network perimeter should be patched and reviewed for signs of prior compromise given evidence of pre-disclosure exploitation.