Check Point patches critical root exploit, FBI seizes DDoS platform, Coast Guard probes tanker cyberattacks

Check Point patches critical authentication bypass allowing root access

Check Point released patches for CVE-2026-91843, a critical stack-based buffer overflow (CVSS 9.8) allowing unauthenticated remote attackers to execute code as root on Security Management and Log Servers. The flaw sits in the login process before authentication and can be triggered by sending an excessively long username. Check Point confirmed automatic updates are already deployed and hotfixes are available for affected versions, though the company has not disclosed who found the vulnerability or whether it has been exploited. [1]

FBI seizes NightmareStresser DDoS-for-hire platform in Operation PowerOFF

The FBI and Royal Canadian Mounted Police seized domains belonging to NightmareStresser, one of the longest-running DDoS-for-hire services active since at least 2022. The platform enabled hundreds of thousands of attacks against educational institutions, government agencies, and gaming platforms, according to the Justice Department. The takedown is part of Operation PowerOFF, an ongoing coordinated effort to dismantle criminal DDoS infrastructure globally. [2]

Coast Guard confirms cyberattack on oil tanker bound for Texas

The Coast Guard and FBI boarded the VL Prosperity supertanker on August 21 after the vessel experienced a cyberattack while transiting the Strait of Gibraltar. Coast Guard Cyber Command confirmed evidence of malicious cyber activity but has not attributed the attack. Iranian media claimed hackers compromised propulsion, navigation and cargo systems and knocked out communications for 30 hours, though the Coast Guard has not confirmed Iran's involvement. [3]