Check Point Gaia Local Root Flaw CVE-2026-123039 Exploited; CISA KEV Deadline 16 November
Check Point says a world-writable root socket in Gaia's Dynamic CLI lets any local user run commands as root, and that it has observed active exploitation against a couple of dozen customers. CISA added it to KEV on 13 November.
Flash Briefings
All briefings →Check Point Gaia Local Root Flaw CVE-2026-123039 Exploited; CISA KEV Deadline 16 November
Check Point says a world-writable root socket in Gaia's Dynamic CLI lets any local user run commands as root, and that it has observed active exploitation against a couple of dozen customers. CISA added it to KEV on 13 November.
Two Barracuda Flaws in KEV, Chainable to Root; Vendor Reports Exploitation. CISA Deadline 13 November
CISA added two Barracuda flaws to its KEV catalog on 10 November. Barracuda says combined exploitation could give root, and says it has identified exploitation activity affecting a small number of organizations.
Poland Takes ePUAP Government Services Platform Offline After Cyberattack
Poland disabled ePUAP, the national platform for submitting official documents online, as a precaution after detecting and stopping a cyberattack. No attribution or data theft has been confirmed, and no restoration date has been given.
Check Point Links Three China-Nexus Clusters Through Sparrow Malware, Including Telecom Intrusions
Check Point Research describes three activity clusters, SilentDelivery, OceanGate and DarkWire, built on the Sparrow framework and tracks a possible shared supplier as CopperDragon. DarkWire targets telecom operators and government bodies, mainly in Latin America.
Deep Analysis
All analysis →UAC-0099: ESET Says This Ukraine-Focused Access Group Handed a Logistics Firm to Sandworm
ESET and CERT-UA reporting documents UAC-0099, a Russia-aligned cluster that targets Ukrainian organisations with the MATCHBOIL downloader, the MATCHWOK and MythicRatatoskr backdoors, and, in one intrusion ESET analysed, handed access to Sandworm before a data-wiping attack.
Unit 42 attributes the Blinder Tunnel campaign to CL-STA-1178, an Iranian-nexus cluster that targeted an Iraqi critical-infrastructure engineer with a fake Dubai Airports coding test, used GitHub for command and control, and built a custom Chisel tunnelling loader.
Harvest Now, Decrypt Later: The Quantum Threat That's Already a Present-Tense Breach
Nation-state actors are reportedly stockpiling encrypted traffic today against the day a quantum computer can read it. With qubit estimates for breaking RSA-2048 collapsing and enterprise migration stuck at roughly 5% readiness, the exposure window is a threat-intel problem now, not a 2030s compliance deadline.
Commentary
All commentary →Fourteen governments adopted the first guidelines for the commercial cyber intrusion industry on 11 November. They are voluntary, carry no penalties and were endorsed by fewer than half of the attending states. Our read on what that means for the market and for defenders.
Old Bugs, Short Deadlines: Nearly One in Five 2026 KEV Additions Is Legacy
Of 284 vulnerabilities CISA added to KEV in 2026 so far, 50 carry CVE IDs from 2024 or earlier, including bugs from 2008. The pattern points at inventory and unsupported software, not at zero-days.
Three Days and a Forensic Triage: What CISA's BOD 26-04 Changed About Patching
Since June, four in five new CISA KEV entries carry a three-day deadline and most come with a forensic triage flag. The data shows a step up from patching to compromise assessment, with consequences beyond federal agencies.