Zero-Days, Data Breaches, and AI's Impact on Cybersecurity

Critical Vulnerabilities Under Active Exploitation:

• Check Point Zero-Day Exploited to Gain Root Access, Deploy Wiper (CVE-2026-123039): A critical zero-day in Check Point's Gaia OS is being actively exploited, allowing attackers to gain root access and deploy wiper malware on VMware ESXi hosts. CISA has added this to its KEV catalog, mandating urgent patching.
• CISA Warns of Actively Exploited Critical Flaw in UnrealIRCd (CVE-2026-114713): CISA has added a critical command injection vulnerability in UnrealIRCd to its KEV catalog. This flaw allows unprivileged users to execute commands with server-level authority and was exploited in the wild shortly after a patch was released.

Data Breaches and Targeted Attacks:

• TSMC Confirms Employee Data Breach via Third-Party Cloud Vendor: Taiwan Semiconductor Manufacturing Company (TSMC) has confirmed a data breach affecting current and former employees, originating from an unnamed third-party cloud vendor. A threat actor is reportedly selling a database containing employee information.
• Kempinski Hotels Guests Targeted by Phishing After Vendor Breach: Luxury hotel group Kempinski has confirmed a data breach originating from a compromised third-party technology partner, exposing guest reservation details. This information is now being used for phishing campaigns targeting guests.
• [UPDATE] Falcon C2 Framework Compromises Browsers to Target Governments: Further analysis of the Falcon C2 framework reveals targeting of Roundcube webmail servers via JavaScript injection. Attackers used malicious browser extensions and fake updates for payload delivery, with new MITRE ATT&CK techniques identified.
• BlackNevas Ransomware Wipes VMware Estate Using Stolen Credentials: The BlackNevas ransomware group destroyed a company's VMware environment by using stolen credentials to access vCenter and abuse legitimate administrative tools to deploy their encryptor.

Industry Trends and Policy Developments:

• White House AI Task Force Urges Cyber Liability Relief for Firms: The Trump administration's AI task force is recommending limited regulatory liability for companies that voluntarily report cybersecurity incidents in good faith, proposing a safe harbor period.
• Forescout Research: AI Finds 66 New TCP/IP Stack Flaws in 90 Hours: Forescout's research demonstrates that commercial AI models can find critical vulnerabilities in foundational networking software significantly faster than manual methods, identifying 66 previously unknown flaws.
• FAA Outage Not a Cyberattack; FBI Investigates Software Update: The nationwide ground stop issued by the FAA was not a cyberattack, according to U.S. officials. The FBI is reportedly investigating a software update as a potential cause for the communications failure.