CYBERSECURITY & AI
Check Point’s September 22 advisory reports attacks against two separate security products. VPN certificate handling in Security Gateway permits unauthenticated code execution; a Security Management flaw enables arbitrary-path script execution. Gateway fixes arrived September 9, while the management fix accompanied this advisory.
Attackers published malicious MemTensor packages on September 23: npm OpenClaw plugin versions 0.1.21, 0.1.23 and 0.1.25, and PyPI MemoryOS 2.0.34. Research identifies a Go implant named sckit that steals developer secrets and contains machinery for spreading through repositories and package registries.
ThreatDown’s September 22 research describes CARBONATO, a botnet targeting unauthenticated Docker services. Its implant installs the legitimate Hermes Agent framework and changes its instructions to support Telegram-directed activity, persistence and credential collection. AI API keys receive particular priority in the recovered instructions.
Google disclosed results from PageBreak on September 24, saying its internal security agent found more than 500 cross-site scripting vulnerabilities in Google applications. The system checks candidate exploits against running environments before passing findings to product teams, instead of relying solely on model-generated code analysis.
AI-written · Original sources linked with each story.