Cybersecurity

Check Point reports sharp September attack rise, citing AI-assisted phishing

Check Point Research attributes a sharp September 2026 rise in attack volume to AI-assisted activity and phishing, but its metric tracks detections per organization, with the monitored population unpublished and blocked attempts pooled with successful intrusions.

Check Point Research reported on Oct. 12 that global attack volume rose sharply in September 2026, attributing the increase mainly to generative-AI-assisted activity and more sophisticated phishing. The metric is average weekly cyberattacks per organization, tracked from February through September 2026 — a rate built from detections in Check Point's telemetry, not a count of confirmed breaches.

That distinction matters because Check Point's own vulnerability work in the same window is a different kind of story: patch dates and confirmed exploitation, not monthly volume averages.

The patch record

Check Point released emergency fixes for two critical flaws. CVE-2026-93616, a pre-authentication path traversal in the Security Management Server web service, was exploited in the wild starting July 23, 2026, and the fix arrived Sept. 22. Check Point describes the exploitation as limited — "only a handful of targeted attacks" on July 23 — with a retrospective investigation needed for systems exposed before Sept. 22. CVE-2026-85102, an improper certificate-validation bug (CWE-295) affecting Security Gateways and Spark firewalls, was patched Sept. 9; exploitation attempts against Spark customers, traced to anonymization infrastructure, started Sept. 12. A third, CVE-2026-91843, was addressed Sept. 16 via LivePatch Take 28/29. Both critical flaws carry a CVSS score of 9.8 — a severity rating, not a count of victims.

The mechanism on CVE-2026-93616 is the part worth sitting with: path traversal plus unsafe file upload in a management server's web service let an unauthenticated attacker place files and execute scripts or load Java classes. That's the appliance handing out security policy, and the prerequisite is network reachability to the management interface, not a stolen credential. For CVE-2026-85102, the failed control is certificate validation during VPN negotiation, enabling pre-authentication code execution.

What's not established: which customers patched when. The July 23 exploitation and the Sept. 22 fix define a window, not any individual organization's exposure. The same goes for the three-day gap between the Sept. 9 patch and Sept. 12 attempts — it says nothing about a given Spark customer's patch history. Over 13,000 internet-exposed Check Point VPN devices exist globally, per the reporting; exposure isn't proof of compromise. CISA added CVE-2026-85102 to its Known Exploited Vulnerabilities catalog on Sept. 22, triggering a federal remediation deadline of Sept. 25. Similar deadline pressure covers related KEV entries, including CVE-2026-93952 (Arista) and CVE-2026-94127 (F5).

Where the naming gets loose

The September volume reporting ties ransomware growth broadly to AI-assisted pressure, with ransomware attacks up 8% from July and nearly double year-over-year. Earlier Check Point data, for August, put weekly attacks per organization at 2,422 and counted 1,042 ransomware attacks. Those are reported figures, and the monitored population behind the trend line remains unpublished, so a rise could reflect more sensors reporting rather than more attacks. The split between blocked attempts and successful intrusions isn't given either.

Separately, The Gentlemen claimed a breach of MoneyGram, a payment network serving roughly 60 million customers; the group's posting is a claim, no breached data samples surfaced publicly at the time of analysis, and MoneyGram hasn't confirmed it. The group previously hit MIP Holdings in June 2026, demanding and receiving a ransom and later targeting MIP's clients with separate demands — an account that shows a payment didn't end the relationship. Group names here are labels tied to activity patterns; they don't show those actors produced September's totals, and the MoneyGram claim isn't dated to the September spike Check Point measured.

Three gaps keep the September figure from meaning more than it says. The population is unpublished. Blocked attempts and successful intrusions are pooled. And the daily cycle of threat intensity referenced in the research isn't quantified per hour or region in what's been published.

A rise in detected attempt volume is a real signal about pressure on internet-facing systems. It isn't evidence that defenses failed broadly, or that any named group owned the month.