☕ Good Morning Security Gang,
We’re kicking off the week with ten stories that all reinforce a difficult truth: attackers are no longer focusing solely on your endpoints—they’re targeting the systems you trust to manage and secure everything else. Whether it’s a zero-day in Check Point’s management console, hotel Wi-Fi being weaponized against traveling executives, GitLab’s source code platform becoming a remote code execution target, or attackers controlling the narrative around a major energy company breach, today’s headlines all revolve around compromising the infrastructure we rely on to protect our environments.
The theme throughout today’s episode was simple but powerful: when attackers compromise the control plane, every downstream security assumption begins to collapse. That means security leaders must rethink not only what they protect, but how they validate trust in the systems managing identity, policy, software, and communications.
Double espresso in hand. Coffee Cup Cheers, Security Gang.
🧭 Executive Summary
Today’s cybersecurity news demonstrated that attackers are increasingly pursuing control infrastructure rather than individual endpoints.
Instead of focusing exclusively on user workstations, adversaries are compromising security management consoles, hotel network gateways, collaborative development platforms, and trusted software ecosystems. At the same time, organizations continue struggling with communication during major incidents, often allowing threat actors to shape the public narrative before official investigations conclude.
The lesson is becoming increasingly clear.
Security isn’t just about protecting assets.
It’s about protecting the systems that control those assets.
📰 Top Stories
🚨 Third Check Point Zero-Day of 2026 Targets Security Management Infrastructure
The most urgent story today belongs to Check Point, where a newly disclosed authentication bypass vulnerability affecting Security Management and Multi-Domain Management platforms is already being actively exploited. The flaw allows attackers to obtain application login tokens before authenticating directly into the SmartConsole with full administrative privileges, effectively giving them the ability to modify firewall policies, security configurations, and enterprise management controls from within the organization’s own security infrastructure.
Check Point confirmed exploitation affecting internet-exposed management environments that lacked proper IP-based access restrictions. CISA moved quickly to add the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, marking the third Check Point vulnerability added during 2026 following earlier VPN-related exploits.
Organizations operating Check Point management platforms should immediately restrict external management access, deploy the latest patches, review published indicators of compromise, and verify that management consoles remain isolated from direct internet exposure. Once attackers obtain administrative control of the security platform itself, they no longer require additional vulnerabilities—they already possess the keys to the kingdom.
🏨 Hotel Wi-Fi Becomes a Microsoft 365 Phishing Platform
One of today’s most practical warnings concerns business travelers.
Researchers confirmed attackers have compromised Wi-Fi gateway infrastructure inside hotels and conference facilities across multiple countries, redirecting users toward fraudulent Microsoft 365 authentication pages. Unlike traditional phishing campaigns, these attacks manipulate network infrastructure itself by altering DNS behavior and leveraging Microsoft’s device code authentication workflow to obtain legitimate authentication tokens without ever stealing passwords directly.
The campaign has targeted organizations spanning financial services, healthcare, legal, professional services, retail, and energy sectors, suggesting attackers simply wait for valuable travelers to connect rather than targeting individual industries.
Security teams should strongly consider enforcing always-on full-tunnel VPN connections with encrypted DNS, disabling unnecessary device code authentication within Microsoft Entra ID, and eliminating legacy technologies such as WPAD wherever possible.
Business travel now carries meaningful identity risk that extends far beyond unsecured wireless networks.
⚡ Origin Energy Faces Public Extortion Campaign
Australian utility provider Origin Energy confirmed unauthorized access to customer information while simultaneously confronting an attacker who chose to pressure the organization through media outlets rather than private negotiation channels. According to public claims, nearly two million customer records may have been compromised, although Origin has not independently verified that figure while investigations remain ongoing.
“Silence isn’t neutral during a breach. It simply allows someone else to write your headline.” James Azar
Potentially exposed information includes names, addresses, dates of birth, contact information, account identifiers, and limited financial information. The company has engaged external incident response experts while notifying regulators and law enforcement.
Beyond the technical breach itself, today’s story highlighted an increasingly common extortion strategy.
Threat actors now routinely engage journalists directly, forcing organizations into public response before investigations conclude.
The first public narrative often comes from attackers—not the victims.
That reality places growing importance on proactive crisis communications alongside technical incident response.
💻 GitLab Vulnerability Revives Five-Year-Old Bugs
Researchers successfully chained together two vulnerabilities that quietly existed inside GitLab’s underlying OJ JSON parser for nearly five years, ultimately achieving remote code execution against self-managed GitLab environments. Remarkably, exploitation requires nothing more than ordinary authenticated user permissions capable of pushing source code and viewing notebook file differences. No administrator privileges, CI/CD manipulation, or user interaction are required.
The attack executes code using the GitLab application server’s own privileges, potentially exposing application secrets, service credentials, source code, and any connected resources accessible by the server.
GitLab.com was remediated before public disclosure, but organizations operating self-managed deployments should immediately upgrade affected environments alongside the vulnerable OJ parser library.
The story serves as another reminder that legacy software components can remain dormant for years before researchers discover practical exploitation techniques.
⚡ Need to Know
“Attackers don’t always come after your users anymore they come after the systems managing your users.” James Azar
📦 GitHub and PyPI Introduce Supply Chain Safeguards
GitHub’s Dependabot now delays adoption of newly published packages for up to 72 hours, while PyPI prevents new files from being added to package releases older than fourteen days. Both measures aim to reduce software supply chain attacks targeting newly published malicious packages.
🤖 AI Agent Operates Inside Government Network
Researchers observed an autonomous AI agent performing post-exploitation tasks inside Thailand’s Ministry of Finance after attackers compromised an unauthenticated Hadoop environment. The incident illustrates how AI continues automating routine attacker workflows after initial compromise.
🇺🇸 Cyber Threat Information Sharing Extended
The U.S. House approved legislation extending the Cybersecurity Information Sharing Act of 2015 for another decade, preserving liability protections for organizations sharing cyber threat intelligence with government partners.
✈️ State Department Expands Visa Restrictions
New visa restrictions target foreign cybercriminals involved in scams, sextortion, and organized cybercrime while also extending consequences to immediate family members supporting these operations.
💰 Physical Cryptocurrency Extortion Continues Rising
Researchers documented fifty-two confirmed physical attacks targeting cryptocurrency holders during the first half of the year, demonstrating that executive protection increasingly includes digital asset security as well as traditional cybersecurity measures.
🤖 Hugging Face CEO Calls for Greater AI Transparency
Following last week’s OpenAI incident, Hugging Face CEO Clement Delangue publicly called for OpenAI to release technical traces surrounding the event and dedicate significant computing resources toward helping defenders better understand autonomous AI security risks.
🎯 Key Takeaway
Today’s stories weren’t connected by ransomware.
They weren’t connected by zero-days.
They were connected by trust.
Attackers increasingly seek the systems organizations trust most—security consoles, identity platforms, development infrastructure, and network gateways.
When trust becomes the target, validation becomes the strongest defense.
🧠 James Azar’s CISOs Take
What stood out to me today is that nearly every major incident involved attackers compromising infrastructure that organizations traditionally consider trusted. Security management consoles, hotel Wi-Fi gateways, software development platforms, and shared supplier environments all represent layers we depend upon to secure everything beneath them. That changes how we think about risk. It’s no longer enough to protect endpoints while assuming management infrastructure remains inherently trustworthy. Every control plane must now be monitored, validated, segmented, and continuously assessed with the same rigor we apply to production workloads.
The Origin Energy story also reinforces something security leaders sometimes underestimate during incident response: communication is now part of cybersecurity. Threat actors increasingly understand that controlling the public narrative creates additional leverage during extortion campaigns. If organizations wait too long before communicating, attackers often become the first source customers, regulators, employees, and journalists hear from. Incident response plans should therefore include not only technical containment and forensic investigation, but also a well-rehearsed communications strategy capable of delivering timely, accurate, and transparent updates before misinformation fills the vacuum.
🛠️ Action Items
Immediately patch Check Point Security Management and Multi-Domain Management platforms.
Remove all unnecessary internet exposure from security management consoles.
Review Check Point indicators of compromise for evidence of unauthorized administrative access.
Require always-on VPN with encrypted DNS for employees using hotel or conference Wi-Fi.
Disable Microsoft Entra ID device code authentication where operationally feasible.
Upgrade self-managed GitLab environments to supported releases.
Review software supply chain protections within GitHub and PyPI workflows.
Verify authentication is enabled on Hadoop and Hive deployments.
Update incident response plans to include executive communications and public disclosure workflows.
Review executive travel security guidance with emphasis on identity protection during travel.
Evaluate control-plane infrastructure with the same rigor applied to production assets.
Stay Cyber Safe.
