Check Point patches critical VPN certificate flaws
Check Point has released patches for two major flaws in how its firewall and management products process VPN certificates. Both vulnerabilities could allow unauthenticated remote attackers to run code on affected systems under unspecified conditions. The company says there's no sign of exploitation and that fixes are being distributed. The affected products include certain versions of Security Gateways and the Security Management Server; broader product impact is possible, according to an external advisory.
- Flaws impact certificate handling in VPN products
- Unauthenticated code execution possible under specific conditions
- Check Point began patch rollout on September 9
- No evidence found of in-the-wild attacks
- Broader range of devices may be at risk
Sources covering this
More in Cybersecurity
Microsoft releases record number of security patches
Microsoft released updates to fix at least 974 security vulnerabilities across Windows and other products, its largest patch release to date. The update includes critical flaws, some already being exploited, and over 100 rated as dangers that could let attackers seize control of systems. The unprecedented volume is partly due to the use of AI for vulnerability detection, but experts warn that rapid growth complicates efforts to test and deploy fixes.
OpenAI pledges $1 billion for AI cyber defense program
OpenAI has pledged $1 billion in credits to help organizations defending critical U.S. infrastructure—including water utilities, electric grids, local governments, banks, and nonprofits—access its AI-powered cybersecurity tools, training, and support. The "Daybreak for Frontline Defenders" initiative aims to help these sectors strengthen their defenses as AI-driven cyberattacks become more advanced. OpenAI says it will expand the program to partner countries in the coming weeks.
Liquid Network exploit creates $320 million in unbacked bitcoin
Attackers exploited a software bug in Blockstream's Liquid Network, a Bitcoin sidechain, creating about 4,000 unbacked Liquid Bitcoin (L-BTC) and withdrawing $320 million. The attackers identified themselves as white hat hackers and have returned most funds, retaining around $47 million. According to Blockstream, the incident did not involve compromised multisig keys but was caused by a vulnerability in recent node software.
Cloudflare CASB adds automated security actions
Cloudflare just updated its cloud security tool, CASB, to handle some problems automatically. Now, companies can set rules that instantly revoke risky file sharing or send alerts when something looks off—no need for someone to click through mountains of warnings. This change lets security teams build custom responses to events and takes humans out of the loop for routine fixes.