Weekly Cyber Security Newsletter Covers Certighost, Check Point 0-day, HTTP/2 Flaws, and Notepad++ Abuse
A new cybersecurity newsletter highlights critical vulnerabilities including Certighost in Active Directory, an actively exploited Check Point flaw, multiple HTTP/2 DoS bugs, and malware distributed via Notepad++ plugins.
This week's cybersecurity landscape is marked by a diverse array of threats, detailed in a recent newsletter covering everything from critical Active Directory flaws to the abuse of popular software plugins. A significant disclosure is the Certighost vulnerability (CVE-2026-54121) within Active Directory Certificate Services. This flaw allows a low-privilege domain user to impersonate a Domain Controller by exploiting a "chase" lookup process. Attackers can leverage this to obtain a certificate with a forged DC identity, perform a DCSync attack, extract the krbtgt hash, and seize complete control of the Active Directory domain. Microsoft has addressed this in its July 2026 updates, but a temporary mitigation involves disabling the vulnerable chase fallback.
Adding to the critical alerts, CISA has issued a warning about CVE-2026-16232, a severe improper-authentication vulnerability in Check Point's SmartConsole and management platforms. This flaw, with a CVSS score of 9.3, is being actively exploited in the wild and allows unauthenticated remote attackers to obtain an application login token, granting them full administrative access. Exploitation is possible in environments where management interfaces are exposed to the internet without IP restrictions. Check Point has released a Jumbo Hotfix, and organizations are urged to restrict SmartConsole access to trusted IPs and apply the patch immediately. CISA has also added this CVE to its Known Exploited Vulnerabilities catalog.
In the realm of denial-of-service attacks, researchers have disclosed a class of HTTP/2 vulnerabilities (CVE-2026-44909, CVE-2026-59173, and CVE-2026-59762). These flaws enable unauthenticated attackers to crash servers by manipulating flow-control parameters, leading to memory exhaustion. By manipulating settings like SETTINGS_INITIAL_WINDOW_SIZE or withholding WINDOW_UPDATE frames, attackers can cause servers to generate excessive responses that pile up in memory buffers, potentially triggering out-of-memory conditions or kernel OOM kills. Several vendors, including Apache Traffic Server, Citrix, F5 Networks, and Meta, are affected, while Cloudflare and AMD have confirmed they are not vulnerable. Mitigation strategies include enforcing strict memory limits and terminating connections exhibiting stalled flow-control behavior.
Threat actors are also exploiting the popularity of the Notepad++ text editor. Ukraine's CERT-UA has identified the UAC-0099 threat cluster hijacking legitimate Notepad++ plugins. This is achieved through phishing emails containing a double-extension VBS script disguised as a PDF, which deploys a trojanized "NppExport.dll" alongside a copy of Notepad++. This malicious DLL, tracked as LUNCHPOKE, silently loads upon editor startup and initiates a loader chain (BURNYBEAR → MATCHBOIL.V2) that establishes persistence via scheduled tasks and downloads further payloads. CERT-UA recommends updating Notepad++ to version 8.9.7 and monitoring for unauthorized DLLs and suspicious scheduled tasks.
The newsletter also touches upon a data breach at Ernst & Young (EY), where hackers accessed an IT support system, potentially exposing client tax data. While EY states there's no evidence of data misuse, this incident highlights the persistent risk of attackers targeting IT service-management platforms. Furthermore, Arctic Wolf Labs has traced intrusions to CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks' PAN-OS GlobalProtect, which was used to deploy the Qilin ransomware after attackers gained network access and exfiltrated Active Directory data.
Finally, the report briefly mentions ongoing efforts to patch Linux kernel vulnerabilities, with over 400 addressed recently, underscoring the continuous arms race in cybersecurity. The breadth of issues covered, from enterprise infrastructure flaws to application-level exploits and supply chain risks, paints a picture of a dynamic and challenging threat environment.