Beyond Unified Detection: What Email Security Teams Need to Control

For email security teams, evaluating an integration means understanding both the detections it brings together and the quarantine management and administrative workflows it supports. Proofpoint’s integration with Microsoft’s Integrated Cloud Email Security (ICES) ecosystem brings its post-delivery detections into Microsoft Defender and consolidates investigation and remediation workflows. For customers, the next step is to understand how that integration supports their requirements for administrator-configured enforcement. Within ICES, Microsoft applies enforcement based on submitted verdicts, verdict severity, and configured policies. Proofpoint contributes its assessments within that model; a third-party engine does not independently override a Microsoft malicious verdict through ICES. Customers can […]

The post Beyond Unified Detection: What Email Security Teams Need to Control appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/F15pskD
via

A Critical SSH Password Bypass Hits musl-Based Linux

OpenSSH 10.6p2 shipped on November 5, 2026, and it closes a critical password authentication bypass. On affected systems, anyone who can reach the SSH port can log in without knowing a password.   If you run sshd on musl-based Linux with pluggable authentication modules (PAM) disabled, Alpine Linux being the common example, upgrade today.  At Check Point Software, our testing adds two points to the public advisory. The attack needs a second account that is active and has a real password, because a stored hash alone is not enough. Two conditions are also visible remotely before login: the OpenSSH version in […]

The post A Critical SSH Password Bypass Hits musl-Based Linux appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/gc0eMyu
via

Inside ARTEX: How Autonomous AI Agents Are Being Used in Real-World Cyberattacks

AI agents are already changing how cyberattacks are carried out. Check Point Research (CPR) analyzed ARTEX, an AI-powered penetration testing platform increasingly adopted by cybercriminals and gained rare visibility into how attackers are using autonomous agents from inside their own operator consoles. The findings show that attackers can set an initial objective and leave AI agents to independently find vulnerabilities, exploit systems and pursue that goal at scale, often with very little human involvement. Key Findings ARTEX is already operating at scale: CPR identified 2,557 systems that hosted ARTEX, including 1,608 live, publicly accessible instances at the time of the […]

The post Inside ARTEX: How Autonomous AI Agents Are Being Used in Real-World Cyberattacks appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/hcT5eC2
via

ChatGPT Lockdown Mode Bypass Reveals a Wider Challenge in AI Security

Check Point Research (CPR) discovered a vulnerability that bypassed ChatGPT Lockdown Mode, a security feature designed to reduce prompt-injection-driven data exfiltration. The flaw could enable silent chat data theft, phishing and malware delivery, including zero-click data exfiltration in the ChatGPT desktop application. OpenAI fixed the vulnerability following responsible disclosure, but the finding raises a broader enterprise security issue: AI security controls are only as strong as the wider application environment around them. Key Findings Check Point Research bypassed ChatGPT Lockdown Mode, a security feature specifically designed to limit prompt-injection-driven data exfiltration. The vulnerability could enable multiple attack scenarios, including chat […]

The post ChatGPT Lockdown Mode Bypass Reveals a Wider Challenge in AI Security appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/bYLfVM3
via

Why Pay Twice? One Platform for Enterprise WAF and CDN Speed

Two Teams. Two Priorities. One Application.  Application teams want fast, reliable application delivery without disrupting existing cloud native architectures, CI/CD pipelines, or deployment processes. They want fewer platforms to manage, predictable cloud economics, low latency, and the flexibility to scale without introducing additional operational complexity.  Security teams want enterprise-grade protection for mission-critical applications and APIs, including strong zero-day prevention, low false positives, centralized visibility, and consistent security policies without relying on basic native cloud controls or creating gaps between the CDN and the application.  Check Point WAF Enables Both Teams to Win.  Our WAF comes with a full enterprise-grade CDN […]

The post Why Pay Twice? One Platform for Enterprise WAF and CDN Speed appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/GLs1US9
via

Prompt Adware: How Hidden AI Instructions Could Create a New Enterprise Security Risk

Check Point Research (CPR) discovered Haiou, an OpenAI Codex jailbreak bundle that persistently modifies an AI agent’s trusted instructions to inject advertisements for a third-party AI gateway. CPR calls this behavior “prompt adware,” highlighting how natural-language prompts and configuration files can quietly influence an AI agent’s future behavior without traditional executable code. While the advertisement itself is relatively simple, the technique raises a broader concern for organizations adopting AI agents: how much visibility do they have into the third-party prompts, Skills and configurations influencing the AI systems they trust? Key Findings CPR identified “prompt adware,” where trusted AI instructions are […]

The post Prompt Adware: How Hidden AI Instructions Could Create a New Enterprise Security Risk appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/Fd9y0GW
via

Storm Ransomware Is Scaling Fast and Selling an AI Powered Image

A new ransomware operation appeared in August 2026 with an ambitious pitch: sophisticated infrastructure, aggressive affiliate payouts, global ambitions, and what it calls the “first AI powered, quantum resistant ransomware.”  Within approximately six weeks, Storm had claimed over 50 victims across North America, Europe, and Oceania. Its targets span healthcare, finance, manufacturing, business services, government, transportation, and critical infrastructure.   Storm arrived with the structure of an established Ransomware as a Service operation. Its affiliate program offers revenue shares reaching 90%, while its leak site looks closer to a commercial software platform, complete with an interactive victim map, search functionality, sector […]

The post Storm Ransomware Is Scaling Fast and Selling an AI Powered Image appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/6JgpDom
via