Daily brief · 2026-09-18 · updated 2026-10-12

3 Critical Security Fixes You Need Today

▶

Check Point Security Management and Log Server

Censys and Check Point disclosed CVE-2026-91843, a critical vulnerability in the login process of Check Point Security Management and Log Server. This is a stack-based buffer overflow occurring in the unauthenticated login process. The flaw carries a CVSS score of 9.8, and it allows a remote attacker to execute arbitrary code as root. No credentials are required to trigger this vulnerability.

Why it matters: Without immediate patching, your security infrastructure faces complete remote takeover. This represents one of the most dangerous scenarios in enterprise security. The urgency cannot be overstated given the level of access an attacker gains.

What to do: Apply the LivePatch fix per sk1000155 immediately. Upgrade unsupported branches as soon as possible.

CVEs: CVE-2026-91843

Gyazo user data and image metadata

Helpfeel confirmed that a third party exploited a vulnerability in Gyazo’s image upload server. The attacker gained unauthorized access to Gyazo user data and image metadata. From there, they executed arbitrary commands within the system and accessed the database. The breach resulted in unauthorized disclosure of both user information and image metadata.

Why it matters: Your login credentials may now be in the attacker’s hands, and any images you shared could be exposed. Avoiding password reuse is critical to prevent cascade breaches across other services. Treat any image links you have shared as potentially compromised while Helpfeel’s investigation continues.

What to do: Reset your password and avoid reusing it elsewhere. Review all the image links you have shared for potential exposure.

Microsoft Teams external-collaboration trust

Microsoft documented a campaign exploiting Microsoft Teams external-collaboration trust by having threat actors impersonate IT and helpdesk personnel. A threat actor from a separate tenant initiates contact while impersonating internal IT or helpdesk staff to obtain a remote session. Once they secure access, they use PowerShell to deliver a malicious MSI package. From there, they establish a Node.js backdoor to move laterally over WinRM.

Why it matters: Without proper external collaboration controls, attackers can impersonate your IT staff and trick users into granting remote access. Once they have that access, they can deploy malware and move laterally through your network. Users need training to recognize and reject unsolicited remote-support requests.

What to do: Restrict external collaboration and require verification before remote support. Train users not to approve unsolicited remote-session access.

Tags: check-point-security-management-and-log-server, gyazo-user-data-and-image-metadata, microsoft-teams-external-collaboration-trust