Checkpoint - User Authentication Bypass in VPN Remote Access and Mobile Access

#checkpoint #vulnerabilitymanagement #vulnerability

https://vulnerability.circl.lu/vuln/CVE-2026-50751

In Check Point Firewalls und Gateways gibt es zwei Schwachstellen, von denen eine angegriffen wird (Qilin). Es gibt aber Patches und Gegenmaßnahmen.

https://borncity.com/blog/2026/06/08/schwachstelle-cve-2026-50751-bei-check-point-vpn/

⚠️ CRITICAL: Check Point links VPN zero-day attacks to Qilin ransomware gang

Check Point VPN authentication bypass vulnerability (CVE-2026-50751) in IKEv1 deployments is actively exploited by Qilin ransomware operators since May 7. A few dozen organizations are affected globally with confirmed ransomware incidents tied to this flaw. Organizations running deprecated IKEv1 ke…

https://threatnoir.com/focus

#infosec #cybersecurity

🚨 [CRITICAL INFRASTRUCTURE ALERT]: CVE-2026-50751

• CVE ID: CVE-2026-50751
• CVSS Score: 9.3 (Critical)
• Affected: IKEv1 Setups

What it is:

https://securitycyber.uk

CISA Warns: SolarWinds Serv-U CVE-2026-28318 Actively Exploited — Zero-Auth DoS Attack Hits File Transfer Platform
#CyberSecurity
https://securebulletin.com/cisa-warns-solarwinds-serv-u-cve-2026-28318-actively-exploited-zero-auth-dos-attack-hits-file-transfer-platform/

Geopolitical tensions escalated with Israel and Iran conducting mutual airstrikes (June 8, 2026). In technology, Apple's WWDC unveiled a Gemini-powered Siri (June 7, 2026). Cybersecurity faces immediate threats as CISA warns of active exploitation of a critical SolarWinds Serv-U vulnerability (CVE-2026-28318), urging urgent patching (June 8, 2026). Additionally, phishing now surpasses the Dark Web for stolen personal data.

#AnonNews_irc #Cybersecurity #News

CISA adds SolarWinds Serv-U DoS flaw to KEV (CVE-2026-28318, CVSS 7.5, actively exploited). Patch it. But also ask the question most teams skip: what privileged accounts are attached to that server, and when did anyone last review them?

📰 CISA Mandates Patch for Actively Exploited SolarWinds DoS Flaw Added to KEV Catalog

📢 CISA KEV ALERT! An actively exploited DoS flaw (CVE-2026-28318) in SolarWinds Serv-U is on the loose. Federal agencies must patch by June 19. All orgs using Serv-U are urged to update immediately! 🚨 #CVE #SolarWinds #Infosec #PatchNow

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/cisa-orders-patch-for-actively-exploited-solarwinds-serv-u-dos-vulnerability/?utm_…

Fedify security updates: 1.9.12, 1.10.11, 2.0.20, 2.1.16, and 2.2.5

If you use Fedify, update to a patched release now. CVE-2026-50131 affects Fedify's public URL validation for remote document and media loading. An attacker could use special-use IP address ranges to bypass Fedify's SSRF protections and cause a Fedify server to initiate requests to non-public or special-use network destinations, depending on the deployment environment and network routing.

Fedify validates remote ActivityPub document and media URLs before fetching them, including direct IP literals and hostnames resolved through DNS. The vulnerable path is validatePublicUrl(): affected versions rejected common private and local addresses, but still treated several special-use IPv4 ranges as public internet destinations. That gap could allow outbound requests to ranges such as carrier-grade NAT, benchmarking, multicast, reserved, and documentation networks.

The fix makes Fedify validate resolved addresses against public-network expectations instead of relying on the incomplete denylist. It rejects additional special-use IPv4 ranges and IPv6 translation or tunneling prefixes, including NAT64, Teredo, and 6to4 addresses, before remote document or media fetching proceeds.

Current patched releases are 1.9.12, 1.10.11, 2.0.20, 2.1.16, and 2.2.5. The GitHub Security Advisory is GHSA-xw9q-2mv6-9fr8, and the CVE ID is CVE-2026-50131.

Update @fedify/fedify:

npm  update  @fedify/fedify
yarn upgrade @fedify/fedify
pnpm update  @fedify/fedify
bun  update  @fedify/fedify
deno update  @fedify/fedify

If your project depends directly on @fedify/vocab-runtime, update that package too.

After updating, redeploy. If you run other Fedify-based servers, update those too.

Thanks to Chaitanya Vilas Garware for the report and responsible disclosure.

If anything is unclear, ask below.

Hollo security updates: 0.7.18, 0.8.7, and 0.9.4

If you run Hollo, update to a patched release now. CVE-2026-50131 affects Fedify's SSRF protection, and Hollo depends on Fedify for ActivityPub federation.

Fedify guards against SSRF (Server-Side Request Forgery) when fetching remote ActivityPub objects, documents, and media by validating that the resolved destination is a public IP address. The previous SSRF fix (GHSA-p9cg-vqcc-grcx) blocked common private and local ranges such as 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, and 192.168.0.0/16, but the validation was incomplete—it still treated several special-use IPv4 ranges as public destinations that should have been rejected. These include carrier-grade NAT (100.64.0.0/10), benchmarking and internal testing networks (198.18.0.0/15), multicast (224.0.0.0/4), reserved (240.0.0.0/4), IETF protocol assignments (192.0.0.0/24), and documentation ranges (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24).

An attacker who controls a remote ActivityPub object or media URL could therefore cause a Hollo instance to initiate outbound requests to non-public or special-use network ranges, depending on the deployment environment and network routing.

For full technical details of the underlying vulnerability, see the Fedify security advisory and the Fedify security announcement.

All Hollo versions up to and including 0.7.17, 0.8.6, and 0.9.3 are affected. Patched releases are 0.7.18 for the 0.7.x series, 0.8.7 for the 0.8.x series, and 0.9.4 for the 0.9.x series.

For 0.7.x deployments, update to 0.7.18:

docker pull ghcr.io/fedify-dev/hollo:0.7.18

For 0.8.x deployments, update to 0.8.7:

docker pull ghcr.io/fedify-dev/hollo:0.8.7

For 0.9.x deployments, update to 0.9.4:

docker pull ghcr.io/fedify-dev/hollo:0.9.4

After pulling the new image, restart your Hollo container. If you deploy from source, pull the corresponding release tag and restart.

Thanks to Chaitanya Vilas Garware for the report and responsible disclosure to the Fedify project.

If anything is unclear, ask below.

CISA Adds Actively Exploited Linux Kernel CVE-2022-0492 to KEV Catalog — Patch Now
#CyberSecurity
https://securebulletin.com/cisa-adds-actively-exploited-linux-kernel-cve-2022-0492-to-kev-catalog-patch-now/

Cisco Murmeltier-Tag

Und (fast) täglich grüßt das Murmeltier ... Auf gefährliche #Zero-Day Sicherheitslücken in #Cisco Produkten zu wetten, ist eine ziemlich sichere Bank. Die neu entdeckte Lücke mit der Nummer CVE-2026-20245 (7,8 von 10) wird bereits für Angriffe ausgenutzt. Es gibt keine vorsorgliche Schutzmaßnahme und – Stand heute – auch noch keine Flicken von Cisco. Sämtliche Formen von SD-WAN sind verwundbar, von selber betrieben (on premise) bis Cloud. Die Schwachstelle ist, wie so oft, eine unzureichende Prüfung von Eingaben (insufficient validation of user-supplied input), eines der klassischen Merkmale von Hintertüren. Mit einer passend gedrechselten

https://www.pc-fluesterer.info/wordpress/2026/06/08/cisco-murmeltier-tag/

#0day #closedsource #cybercrime #exploits #hersteller #hintertür #sicherheit #UnplugTrump #wissen

Cisco Catalyst SD-WAN Manager CVE-2026-20245 is being actively exploited with no patch available. CVSS 7.8, affecting on-prem, cloud, and FedRAMP deployments. The CVE is the headline, but it's not the real problem.

🚨 In this week’s newsletter, we cover CVE-2026-8181, a critical authentication bypass vulnerability in the WordPress Burst Statistics plugin now under active exploitation.

We break down how attackers can obtain administrative privileges without valid credentials and what defenders should do next.

Read the full analysis and protect your systems 👉 https://www.crowdsec.net/vulntracking-report/cve-2026-8181-wordpress-burst-statistics-authentication-bypass

⚠️ CVE-2026-11482: MEDIUM severity SQL injection in SourceCodester Class and Exam Timetabling System 1.0 via 'sy' param in /archive5.php. No official patch yet — apply mitigations & monitor for attacks. https://radar.offseq.com/threat/cve-2026-11482-sql-injection-in-sourcecodester-cla-fd3076ab #OffSeq #SQLInjection #Vuln #InfoSec

CVE-2026-11482 - SQLi in Sourcecodester Class & Exam Timetabling System 1.0. Remote exploit via /archive5.php?sy. CVSS 7.3. No patch available. Apply WAF rules immediately. #CVE #infosec #cybersecurity

https://www.valtersit.com/cve/CVE-2026-11482/