October 'In Trend VM' Report: Exploited Windows ALPC and Check Point VPN Vulnerabilities
Positive Technologies has published its October edition of the In Trend VM digest, focusing on two actively exploited vulnerabilities in Microsoft Windows and Check Point products.
The first vulnerability, tracked as PT-2026-88151 (CVE-2026-85880, CVSS 7.8), affects the ALPC inter-process communication mechanism in Windows. It allows an attacker running code inside an AppContainer sandbox to escape and escalate privileges to SYSTEM level without user interaction. Microsoft marked the issue as a zero-day, and CISA added it to the Known Exploited Vulnerabilities catalog on September 8.
Researchers from Proofpoint and Volexity linked the flaw to the BlueMoon attack chain that combined two Chrome V8 remote code execution vulnerabilities (CVE-2026-85046 and CVE-2026-87491) with CVE-2026-85880. Multiple clusters, including TA412 (also known as JungleBamboo, APT31, Violet Typhoon), UTA0560, UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket, and UTA0565, used the chain against U.S. nonprofits, mining companies, aerospace firms, and organizations in Indonesia and Singapore. Backdoors observed include GRIMWEDGE and ShadowPad.
The second vulnerability, PT-2026-88979 (CVE-2026-85102, CVSS 9.8), resides in Check Point Security Gateway and Spark Firewall devices. It stems from improper validation of X.509 certificates during VPN negotiation and allows unauthenticated remote attackers to execute arbitrary code with system privileges. Check Point began observing exploitation attempts on September 12, primarily targeting Spark Firewall customers, and CISA added the CVE to KEV on September 22. A public proof-of-concept exploit is available.
Affected systems include approximately 12,000 Check Point gateways with active VPN services exposed online. Patches were released on September 9 via LivePatch and Jumbo Hotfix Accumulator packages. Organizations unable to patch immediately are advised to restrict IKE and NAT-T traffic to trusted IP addresses for site-to-site VPNs.
Both vulnerabilities are now tracked in Positive Technologies' MaxPatrol VM vulnerability management platform within 12 hours of disclosure.
Related articles
Windows PHP Updated to Patch Critical Brotli Vulnerability CVE-2026-111497
The PHP development team has released updated Windows builds of PHP that bundle a patched version of the Brotli compression library. The update addresses CVE-2026-111497, a critical out-of-bounds write flaw in Google's Brotli decoder that can lead to remote code execution, information disclosure, or denial of service. The vulnerability carries a CVSS v4.0 base score of 9.2 and is rated Critical. It affects PHP environments where the cURL extension has automatic decompression of HTTP responses enabled, allowing Brotli decoding to occur. Although cURL automatic decompression is disabled by default, applications or HTTP client libraries may enable it. The fix updates the bundled Brotli component to version 1.2.1 in the releases PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 published on October 26.
AI-Driven Software Boom Fuels Record Surge in Critical Vulnerabilities in 2026
The National Vulnerability Database recorded more than 72,000 CVEs between January and September 2026, compared with 48,244 for the entire previous year. The increase stems directly from the massive growth in code volume produced with AI coding assistants that allow features once requiring two weeks to be completed in a single afternoon. Much of this newly generated code reaches production without thorough human security review because models optimize for functionality rather than adversarial misuse. Common flaws such as missing authorization checks, exposed API keys in repositories, and insecure direct object references appear repeatedly in freshly deployed applications. Criminal groups have adopted the same AI tools to scan and test targets at scale, widening the gap between attacker speed and defender verification processes. Organizations that skip structured adversarial testing leave these issues to be discovered by threat actors, resulting in data exposure and operational disruption far costlier than pre-release remediation.
Apple Releases iOS 27.2 and iPadOS 27.2, Patching 163 Vulnerabilities Including Exploited Flaws in Older Versions
Apple has issued security updates for iOS and iPadOS, addressing a wide range of vulnerabilities across current and legacy operating systems. The iOS 27.2 and iPadOS 27.2 releases fix 163 CVEs affecting WebKit, the kernel, and image processing components. Older branches received targeted patches, with iOS 26.7.2 resolving 134 issues and iOS 18.7.11 addressing three vulnerabilities that include an actively exploited flaw. Specific fixes cover remote code execution risks in WebKit and ImageIO, plus sandbox bypasses. The updates were published on October 26, 2026, and apply to both iPhone and iPad devices. Apple also published detailed security content advisories for each branch.
CISA Adds PHP2Shell Flaws CVE-2026-109618 and CVE-2026-109619 to KEV Catalog After Confirmed Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency has confirmed active exploitation of two remotely exploitable vulnerabilities in PHP collectively known as PHP2Shell. CVE-2026-109618 stems from improper handling during memory exhaustion, while CVE-2026-109619 involves use-after-free issues in internal state management. Both flaws allow unauthenticated remote code execution and pose elevated risk to any PHP environment processing external requests such as web servers. PHP development teams released patches on October 21 for supported branches including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, along with source-level fixes for end-of-life versions 7.4, 8.0 and 8.1. CISA has set a three-day remediation deadline of October 29 for U.S. federal agencies and requires verification that systems have not been compromised.