grep -rl "edge-devices" ./articles
CVE-2026-85102 and CVE-2026-85103 both sit in VPN certificate handling on Check Point gateways and management servers, and both run before authentication. Check Point found them itself and has seen no exploitation. The end-of-support releases it lists as affected get no fix at all.
Sophos documented malware that infects the Apache binary on F5 BIG-IP APM, hooks the runtime as PHP loads, and writes a web shell into memory in front of three real scripts. File integrity checks pass. The entry point, CVE-2025-53521, was published as a DoS in October 2025 and reclassified as unauthenticated RCE five months later.
CERT Polska and MikroTik have named the chain MikroTrick. CVE-2026-67276 validates only an SSH key's type and modulus, so anyone who knows an authorised user's public modulus can forge a key without the private half. CVE-2026-86060 then turns a crafted username into a command-line argument and hands over administrator.
CVE-2026-8037 is a CVSS 9.6 command injection in Progress Kemp LoadMaster, traced to its escape_quotes() routine. 792 exploitation attempts over 41 days from 65 IPs across 18 countries — and the federal remediation deadline is today.
Volexity says a threat actor it tracks as UTA0533 is harvesting credentials from compromised SonicWall appliances, and researchers note INC Ransomware has picked up its pace since the start of August.