A Check Point zero-day that has been actively exploited for two weeks delivers root access and destructive ESXi file wipes. Apache patches an unauthenticated RCE in its HTTP/2 module that affects roughly a third of the internet’s web servers. A state-level actor is intercepting SMS 2FA at the carrier infrastructure layer. And nearly five thousand hijacked GitHub accounts are planting credential stealers in CI pipelines right now.

In the News

Check Point Zero-Day Exploited Since October 30 - Root Access and ESXi Destruction

Attackers have been exploiting CVE-2026-123039 in Check Point Gaia OS for two weeks to gain root access on security gateways. The attack chain starts with PHP2Shell for initial code execution on the gateway, then escalates privileges via the newly disclosed local privilege escalation flaw to reach root. From there, operators deploy the TSGA backdoor for persistent access and proceed to wipe ESXi files - a destructive endgame that goes beyond data theft or ransomware.

The targets are Israeli organizations. Check Point has released emergency hotfixes, but the two-week exploitation window before public disclosure means defenders should assume compromise and hunt, not just patch. The CVSS 8.8 score reflects the local privilege escalation component - the full chain severity is higher when accounting for the PHP2Shell initial access vector.

The operational question for any organization running Check Point gateways: do you have compensating controls - EDR on gateway hosts, network segmentation isolating management planes, immutable ESXi snapshots - that survive if the perimeter device itself is the point of compromise? A security gateway that becomes the initial access vector inverts the entire defensive model.

What defenders should do: Apply Check Point emergency hotfixes immediately. Hunt for TSGA backdoor indicators on Gaia OS appliances. Verify ESXi backup integrity and snapshot immutability. Review gateway management plane network segmentation - MITRE ATT&CK T1068 (Exploitation for Privilege Escalation) and T1485 (Data Destruction).

SilentAir APT Hijacks Six Asian Telecoms to Intercept SMS 2FA

A state-level threat actor tracked as SilentAir compromised network equipment inside at least six Asian mobile operators to intercept calls and SMS messages, primarily targeting Taiwan. This is not SIM-swapping. This is not endpoint phishing. This is SS7/Diameter-layer infrastructure compromise - the attacker is inside the carrier network, intercepting messages before they reach the handset.

Enea’s report identifies the campaign as high-confidence state-sponsored espionage. The implications extend beyond intelligence collection: any organization relying on SMS-based one-time codes for authentication is exposed to an interception method that operates entirely below the application layer. Standard enterprise security controls - EDR, email security, web filtering - do not see this traffic.

What defenders should do: Migrate all authentication to phishing-resistant MFA (FIDO2, hardware security keys). SMS-based 2FA is now demonstrably compromised at the infrastructure layer. Organizations with APAC presence should evaluate carrier security SLAs and consider out-of-band authentication channels that do not traverse the mobile network - MITRE ATT&CK T1111 (Multi-Factor Authentication Interception).

Apache HTTP Server Patches Critical RCE in mod_http2 - CVE-2026-119618

A race condition in Apache HTTP Server’s mod_http2 module (CVE-2026-119618, CVSS 9.3) enables unauthenticated remote code execution on servers running versions 2.4.55 through 2.4.70. The flaw was discovered by researchers from Anthropic and Google. Apache released version 2.4.71 on November 12.

The exposure surface is enormous. Apache HTTP Server powers a significant share of the world’s web infrastructure, and HTTP/2 is enabled by default in most modern configurations. The vulnerability requires no authentication and no user interaction - a remote attacker sends crafted HTTP/2 requests to trigger the race condition. This is not a theoretical bug class; race conditions in HTTP/2 implementations have produced exploitable RCEs before.

What defenders should do: Upgrade to Apache 2.4.71 on all HTTP/2-enabled servers. If immediate patching is not possible, disable mod_http2 as a compensating control. Verify that WAF and reverse proxy deployments inspect HTTP/2 traffic at the protocol level - many WAF configurations terminate HTTP/2 to HTTP/1.1, which may or may not cover this specific race condition. Scan the full server fleet for affected versions - MITRE ATT&CK T1190 (Exploit Public-Facing Application).

4,837 Hijacked GitHub Accounts Plant CI Secret-Stealers in 1,806 Repos

A large-scale supply-chain campaign compromised 4,837 GitHub accounts to inject secret-stealing code into GitHub Actions workflows across 1,806 repositories. The malicious workflows target AWS, GCP, and Azure credentials exposed during CI pipeline runs. The campaign started Tuesday and is likely still active.

The attack exploits a fundamental weakness in CI/CD trust models: organizations pull workflow definitions and dependencies from public repositories without verifying integrity at the pipeline level. When an attacker controls the upstream account, every downstream build that references those workflows becomes a credential exfiltration opportunity. Secrets stored as GitHub Actions environment variables or passed as build arguments are the primary targets.

What defenders should do: Audit all GitHub Actions workflows for unexpected modifications since November 11. Pin action references to specific commit SHAs rather than tags or branch names. Rotate all cloud provider credentials that were accessible to CI pipelines during the exposure window. Implement secrets management solutions that scope credentials with least-privilege and expire them automatically - MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain).

Today’s Deep Dive - MSP Supply-Chain Risk: SCKit, N-able, and the RMM Attack Surface

Two separate incidents this week demonstrate that remote monitoring and management (RMM) tools remain one of the highest-value attack surfaces for threat actors targeting managed service providers.

SCKit worm-like malware exploits CVE-2026-84869 - a patched ScreenConnect vulnerability - to spread bidirectionally between customer endpoints and MSP technician machines. The malware propagates through active ScreenConnect sessions: when an MSP tech connects to a compromised customer endpoint, SCKit crosses the session boundary onto the tech’s workstation. From there, it spreads to every other customer the tech subsequently connects to. ConnectWise has disabled five third-party extensions in response. The count so far: 288 endpoints across 48 organizations.

Separately, the 4EverAble2Shell zero-day in N-able N-central was exploited within hours of public PoC release. Of the 21 compromised servers, 19 were running the latest hotfix - the vulnerability existed in the Legacy API, a non-default configuration that many administrators had enabled for integration purposes. N-able has restricted Legacy API features, but the exploitation window was measured in hours, not days.

The pattern is consistent: RMM platforms provide authenticated, trusted, admin-level access to hundreds or thousands of endpoints. Compromising a single RMM session or server cascades across the entire customer base. For MSPs and their customers, this means RMM platform selection, configuration hardening, and session-level access controls are security-critical decisions - not just operational convenience choices.

Detection for SCKit should focus on unusual ScreenConnect session behaviors - new outbound connections from tech workstations to previously unconnected endpoints, and unexpected file writes during remote sessions. For N-central, audit Legacy API access logs and look for API calls from non-allowlisted IPs - MITRE ATT&CK T1219 (Remote Access Software) and T1199 (Trusted Relationship).

Defender Action Items

  • Apply Check Point Gaia OS emergency hotfix for CVE-2026-123039 and hunt for TSGA backdoor indicators on all Check Point appliances
  • Upgrade Apache HTTP Server to 2.4.71 on all HTTP/2-enabled servers - or disable mod_http2 as interim mitigation
  • Audit GitHub Actions workflows for unauthorized modifications since November 11 and rotate cloud credentials exposed to CI pipelines
  • Migrate SMS-based 2FA to FIDO2/hardware tokens - SilentAir demonstrates infrastructure-layer interception
  • Patch Citrix NetScaler ADC/Gateway for CVE-2026-120868 and nine additional critical-severity flaws
  • MSPs: verify ScreenConnect is patched against CVE-2026-84869, disable unnecessary third-party extensions, and audit N-central Legacy API configurations

Detection Spotlight

ScreenConnect session anomaly detection - identify potential SCKit propagation by looking for a single technician workstation initiating connections to an unusual number of customer endpoints within a short window. In Splunk SPL:

index=screenconnect sourcetype="screenconnect:sessions"
| stats dc(target_host) as unique_targets earliest(_time) as first_seen latest(_time) as last_seen by tech_user src_host
| eval session_window_mins=round((last_seen-first_seen)/60,1)
| where unique_targets > 15 AND session_window_mins < 60
| sort -unique_targets
| table tech_user src_host unique_targets session_window_mins first_seen last_seen

This query flags technician workstations that connected to more than 15 unique customer endpoints within a 60-minute window - a behavioral indicator of worm-like propagation through RMM sessions. Tune the threshold based on your MSP’s normal session volume. False positives will come from legitimate bulk maintenance windows; correlate with change management schedules.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.