Check Point and F5 flaws under attack, Astrana Health files an 8-K, and Anduril needs a CISO

If you do one thing before Monday, check your Check Point management servers and F5 BIG-IP APM appliances: both are being exploited, and CISA has put the flaws on its must-patch list. Also in this edition: a healthcare company's 8-K describing a phone-based social engineering intrusion, a takedown of a phishing service that reached 12,000 inboxes, and an open CISO seat at Anduril.

Check Point management servers were exploited for two months before a fix

Check Point shipped emergency fixes for CVE-2026-93616, a pre-authentication path traversal flaw in the web service of its Management Server, Log Server and SmartEvent products, and said a handful of customers had already been attacked. Help Net Security reports exploitation dating back to July 23, 2026. A second flaw, CVE-2026-85102 in Quantum Security Gateway and Spark firewalls, was patched on September 9 and began drawing exploitation attempts soon after. If the hotfix cannot go in at once, Check Point's interim advice is to restrict management server access to trusted internal IP addresses. (Help Net Security)

Six more exploited flaws on CISA's KEV list, including F5 and SharePoint

On Tuesday, September 22, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on evidence of active exploitation: the two Check Point flaws above, an input validation bug in Arista VeloCloud Orchestrator (CVE-2026-93952) and a heap-based buffer overflow in F5 BIG-IP APM (CVE-2026-94127). On Friday it added two more, a code injection flaw in Microsoft SharePoint (CVE-2026-65660) and a MikroTik RouterOS weakness (CVE-2026-67279). Under Binding Operational Directive 26-04, federal civilian agencies must prioritize KEV entries on exposed assets; CISA urges everyone else to do the same. (CISA, CISA)

Astrana Health reports a material incident that began with spoofed phone calls

Astrana Health disclosed a material cybersecurity incident under Item 1.05 in a Form 8-K dated September 22. The filing says attackers impersonated company staff and spoofed its main corporate phone number to call employees and seek access to systems at its subsidiary Astrana Health Management. The company believes some private or confidential data was accessed or taken, is still working out whether patient, employee or provider information was involved, and determined the incident material as of September 22 because of the data at stake. For CISOs, it is another help-desk and voice-phishing case worth a tabletop. (SEC EDGAR)

Microsoft-led coalition takes down the EvilTokens phishing service

A coalition led by Microsoft, acting under an order from the US District Court for the Eastern District of Virginia, seized 50 websites and disabled more than 150 domains behind EvilTokens, a phishing service that compromised more than 12,000 inboxes at over 10,000 organizations. The service, launched in February 2026, tricked victims into entering an authentication code on Microsoft's real sign-in page and then gave criminals an AI chatbot to mine the mailboxes. The Metropolitan Police Service's cybercrime team arrested two men on September 11 in connection with it. Phishing that abuses genuine sign-in codes is worth a fresh look in your conditional access rules. (Help Net Security)

Elsevier domains briefly redirected to a LAPSUS$ page

For at least 78 minutes on the evening of September 21, three Elsevier properties, including elsevier.com and its manuscript submission portal, redirected visitors to a page branded "LAPSUS$ GROUP, Chapter II." Researchers at Cloudskope believe the change happened at the DNS or CDN layer. Elsevier had not explained the cause when Help Net Security reported it, and the sites were working again. The lesson for security teams is the familiar one: the accounts that control DNS and CDN rules are crown jewels and need the same protection as production admin access. (Help Net Security)

Anduril's CISO steps away after seven years at the company

Joe McCaffrey is leaving defense startup Anduril after seven years, three of them as chief information security officer, for a new role he has not yet named, The Stack reports. The company is recruiting a successor and, according to the publication's headline, is offering up to $380k for the seat. The appointment record lives on CISO Tribune. (The Stack)

CISA publishes a plan to raise the quality of CVE records

CISA released a whitepaper, "CVE Program: Establishing a Quality Era Framework," setting out how it intends to mature the Common Vulnerabilities and Exposures program, with a definition of quality, a roadmap and measures of success. Vulnerability management teams that depend on CVE data for prioritization and SLA tracking should read it for what may change in the records they consume. (CISA)