Response

RESPONSE · NEW YORK

Check Point Patches Actively Exploited Management Server Path Traversal

For security operations teams, management-plane compromise is an identity and control-plane incident, not only an appliance patch ticket.

Noah Park, Response, New York

RESPONSE · NEW YORK

F5 Warns of Exploited BIG-IP APM Flaw Enabling Unauthenticated Remote Code Execution

NEW YORK - F5 Networks has confirmed a critical heap-based buffer overflow in BIG-IP Access Policy Manager is under active exploitation, and CISA added it to the Known Exploited Vulnerabilities catalog.

Noah Park, Response, New York

Text desk note. No incident photograph.

RESPONSE · WASHINGTON

CISA Flags TeamCity Flaw CVE-2026-63077 as Used in Ransomware Campaigns

WASHINGTON - The Cybersecurity and Infrastructure Security Agency has updated its Known Exploited Vulnerabilities catalog so that CVE-2026-63077, a critical JetBrains TeamCity On-Premises flaw, is now marked with known ransomware campaign use. Trade press reported the KEV change on Wednesday, September 23, 2026. CISA first added the vulnerability to the catalog on August 5, 2026, after evidence of active exploitation. The live KEV feed lists knownRansomwareCampaignUse as Known for this CVE.

Noah Park, Response, New York

Text desk note. No incident photograph.

RESPONSE · NEW YORK

WordPress Core Path Traversal CVE-2026-87902 Moves From Probe to Code Execution

Patchstack and other defenders report pearcmd-based file writes against unpatched WordPress after CVE-2026-87902 disclosure, turning a template-resolution path traversal into a SOC containment problem.

Noah Park, Response, New York

Text desk note. No incident photograph.