October 'In Trend VM' Report: Exploited Windows ALPC and Check Point VPN Vulnerabilities
Positive Technologies has published its October edition of the In Trend VM digest, focusing on two actively exploited vulnerabilities in Microsoft Windows and Check Point products.
The first vulnerability, tracked as PT-2026-88151 (CVE-2026-85880, CVSS 7.8), affects the ALPC inter-process communication mechanism in Windows. It allows an attacker running code inside an AppContainer sandbox to escape and escalate privileges to SYSTEM level without user interaction. Microsoft marked the issue as a zero-day, and CISA added it to the Known Exploited Vulnerabilities catalog on September 8.
Researchers from Proofpoint and Volexity linked the flaw to the BlueMoon attack chain that combined two Chrome V8 remote code execution vulnerabilities (CVE-2026-85046 and CVE-2026-87491) with CVE-2026-85880. Multiple clusters, including TA412 (also known as JungleBamboo, APT31, Violet Typhoon), UTA0560, UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket, and UTA0565, used the chain against U.S. nonprofits, mining companies, aerospace firms, and organizations in Indonesia and Singapore. Backdoors observed include GRIMWEDGE and ShadowPad.
The second vulnerability, PT-2026-88979 (CVE-2026-85102, CVSS 9.8), resides in Check Point Security Gateway and Spark Firewall devices. It stems from improper validation of X.509 certificates during VPN negotiation and allows unauthenticated remote attackers to execute arbitrary code with system privileges. Check Point began observing exploitation attempts on September 12, primarily targeting Spark Firewall customers, and CISA added the CVE to KEV on September 22. A public proof-of-concept exploit is available.
Affected systems include approximately 12,000 Check Point gateways with active VPN services exposed online. Patches were released on September 9 via LivePatch and Jumbo Hotfix Accumulator packages. Organizations unable to patch immediately are advised to restrict IKE and NAT-T traffic to trusted IP addresses for site-to-site VPNs.
Both vulnerabilities are now tracked in Positive Technologies' MaxPatrol VM vulnerability management platform within 12 hours of disclosure.
Related articles
Fuzzilli vs BigSleep: 37 and 45 Vulnerabilities Found in V8 Over Six Months with 25% Overlap
Google's Project Zero compared two automated vulnerability discovery tools targeting the V8 JavaScript engine in Chrome. The generative fuzzer Fuzzilli identified 37 actionable vulnerabilities over six months, while the LLM-based agent BigSleep found 45. Only about 25% of the vulnerabilities overlapped between the two systems. Additional experiments on historical bugs from 2023 onward showed a theoretical overlap of around 60%. The analysis indicates that fuzzing and LLM agents complement each other rather than one replacing the other. Researchers recommend using both approaches together to maximize coverage of complex bugs in well-tested software like V8.
ISPsystem Publishes Detailed Timeline of VMmanager 6 Attack and Vulnerability Analysis
ISPsystem has released a comprehensive post detailing a recent security incident targeting its VMmanager 6 virtualization management platform. The company outlines the chronology of the attack, the specific vulnerabilities exploited by threat actors, and the current mitigation status. The incident has sparked significant discussion within the professional hosting and virtualization community. ISPsystem emphasizes transparency and provides technical breakdowns to help users understand the attack vectors and required defensive measures. The post covers how the attackers gained initial access and the subsequent impact on managed virtual environments.
Google Fixes 52 Vulnerabilities in Chrome Including Four Critical Issues
Google has released security updates for its Chrome browser that address a total of 52 vulnerabilities. Four of these flaws received the highest severity rating of Critical. The updates were issued on October 27, 2026, for Windows, macOS, and Linux platforms. The critical vulnerabilities include memory corruption in the file system, input validation issues in the file API, problems in the Skia graphics library, and a Use After Free flaw in the Layout component. Specific CVEs patched are CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, and CVE-2026-118344. The remaining 48 vulnerabilities received lower severity ratings but were still addressed in the same release.
CISA Adds Brotli and Adobe Commerce Flaws to Known Exploited Vulnerabilities Catalog
The U.S. Cybersecurity and Infrastructure Security Agency has added two vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. CVE-2026-111497 affects Google’s Brotli data compression library and can lead to code execution, information disclosure, or denial of service when specially crafted compressed data is processed. The flaw impacts any software that incorporates the Brotli decoder for decompression tasks, prompting vendors to release updates. CVE-2026-48356 resides in the file upload functionality of Adobe Commerce and Magento, allowing attackers to exploit improper handling during upload operations. CISA issued the alert on October 27, 2026, urging organizations to apply patches immediately to mitigate ongoing attacks. Related advisories also reference Brotli fixes in PHP and other products that bundle the library.