Daily · 2026-07-23
🔴 Check Point SmartConsole Zero-Day KEV, 🎯 Iranian ICS Attacks Target Siemens/Schneider, ⚠️ RefluXFS Linux LPE, 🛡️ Supply Chain Worm Wave Hits npm/PyPI, 📋 Suno 55M Breach
CISA adds Check Point SmartConsole zero-day to KEV with July 25 deadline; US warns Iranian hackers now targeting Siemens, Schneider, and Rockwell ICS PLCs; RefluXFS Linux kernel LPE in XFS (CVE-2026-64600) gives root even with SELinux; GitGuardian documents four more npm/PyPI supply chain attacks including IronWorm with eBPF rootkit; Suno (55.3M) and Paidwork (23.3M) data breaches exposed via HIBP.
The Check Point SmartConsole zero-day is the day's defining story, and it carries a deadline. CVE-2026-16232 gives unauthenticated attackers an administrator login token on Security Management Servers and MDS, needs only an internet-exposed management IP, and is already exploited. CISA set a July 25 federal remediation date, and it is the third Check Point CVE on KEV this year.
The updated US advisory on Iranian ICS activity is the higher-consequence item. CyberAv3ngers and Handala are using vendor configuration software to rewrite Siemens, Schneider and Rockwell PLC logic, disabling shutdown and alarm functions so facilities fail without operator notification. The advisory applies to any internet-exposed PLC, which should be assumed reachable and its program verified.
Around them: Langflow exploitation telemetry shows 220 attempts from 64 IPs before KEV inclusion, making it the first AI agent framework on the catalog. The Sandworm_Mode worm extends the Shai-Hulud family into AI coding toolchains, and RefluXFS is a reliable XFS root escalation that leaves no kernel log behind.
Watchlist: Check Point management exposure, PLC program integrity checks, and the AI toolchain supply chain, where credential theft is now the main event.