As interest in new AI tools accelerates, cybercriminals are finding ways to exploit the trust surrounding them. Check Point Research (CPR) has uncovered Yoba, a malware campaign using fake GitHub projects impersonating supposed ChatGPT and Claude desktop applications, while abusing legitimate, signed OpenAI and Anthropic executables to help load malware. The campaign shows how the rush to access new AI tools is creating opportunities for social engineering, even when the AI platforms themselves have not been compromised. Key Findings Attackers used fake GitHub projects impersonating supposed ChatGPT and Claude desktop applications to distribute Yoba malware. Legitimate, signed OpenAI and Anthropic […]

The post Yoba Malware Abuses Signed ChatGPT and Claude Binaries to Target AI Users appeared first on Check Point Blog.

In a short period, Check Point has appeared across three new Gartner research publications examining autonomous remediation, exposure assessment, and the future of preemptive cybersecurity. These three reports ask very different questions. But how do they connect? One examines how organizations can trust autonomous remediation. Another looks at the growing exposure management market and the increasing importance of exploitability. The third looks further ahead at the technologies Gartner believes will shape preemptive cybersecurity. Taken together, the reports capture a broader change already underway across the industry. Exposure management is expanding from identifying risk toward understanding exploitability and enabling action. Exploitability […]

The post Three Gartner Reports. One Emerging Direction for Exposure Management. appeared first on Check Point Blog.

Every partner knows this conversation. A customer agrees their firewalls need replacing. Their teams are using AI tools, they are connecting more systems, and the threats are moving faster than their hardware was built for. They want to upgrade. Then the quote goes into the capital approval process, and the deal goes quiet. This year, that conversation is happening more often. Today we launched Firewall-as-a-Subscription to help partners get those deals moving again. Why deals are stalling Inflation and rising interest rates are increasing borrowing costs and shrinking capital budgets, and security is feeling the pressure. According to the IANS […]

The post Budgets Are Stalling Firewall Deals. Here’s How Partners Can Get Them Moving Again appeared first on Check Point Blog.

Check Point’s Firewall-as-a-Subscription Puts Advanced AI-Era Protection Within Reach of Every Organization Attacks don’t wait for budget approval. But firewall purchases often do, and that wait is getting longer. Rising interest rates have made borrowing more expensive. For a midsize company, a single rate rise can cost the equivalent of a branch office firewall. A large hardware purchase now means a harder conversation with finance and a longer approval cycle. Meanwhile, the old firewall stays in place; the network grows, and so does the risk. Security is urgent. The way organizations pay for it isn’t keeping pace. Check Point Firewall-as-a-Subscription […]

The post Rising Borrowing Costs Shouldn’t Delay Your Security: Meet Firewall-as-a-Subscription appeared first on Check Point Blog.

How 300 Academic Partnerships Are Helping Close the Cyber Skills Gap Check Point’s SecureAcademy has reached 300 academic partnerships across more than 80 countries, connecting educational institutions with industry-aligned cyber security training and resources. While the milestone reflects the program’s continued growth, it also highlights a broader shift: educational institutions are increasingly looking for ways to align cyber security education with the skills employers need today. Turning Classrooms into Career Pathways Organizations worldwide continue to face a shortage of cyber security professionals, while educational institutions are under pressure to keep pace with rapidly evolving technologies and threats. Through SecureAcademy, institutions […]

The post Closing the Cyber Skills Gap with 300 Academic Partnerships appeared first on Check Point Blog.

AI assistants have quickly become part of everyday work, particularly for developers. Tools such as ChatGPT, Claude, Cursor and GitHub Copilot increasingly sit alongside source code, cloud environments and other sensitive business resources, making the credentials and sessions connected to these tools increasingly important to protect. New research from Check Point Research (CPR) into the Aokigahara infostealer shows how attackers are adapting to this shift. The malware specifically collects authentication files, session data and configuration files associated with popular AI applications and development tools. The significance goes beyond gaining access to an AI account. If stolen credentials or session tokens […]

The post Infostealers Are Targeting AI: What Aokigahara Infostealer Reveals About the New Developer Attack Surface appeared first on Check Point Blog.

When the PHP2Shell vulnerabilities became public, my thoughts went back to Log4Shell.  Five years ago, Log4Shell showed how difficult it can be to respond to a critical vulnerability in software used across countless applications and services. PHP2Shell presents a similar challenge. The technical details are different, but the need to quickly understand where you’re exposed and take action is very familiar.  I believe we should expect more incidents like this. AI is making it possible to discover vulnerabilities in widely used software at a speed and scale we haven’t seen before. As these capabilities become more accessible, we are likely […]

The post PHP2Shell: Log4Shell at AI Speed — A CISO’s Perspective appeared first on Check Point Blog.

Two critical vulnerabilities in PHP, the programming language behind a large share of the world’s websites, online stores and internet services, are being actively targeted. Since details of CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, leaked ahead of planned disclosure, 10% of organisations worldwide have been impacted (“impacted” means exploitation attempts, we have no way of knowing if the attack has been successful), according to Check Point Research. Hourly activity peaks at midnight, when fewer security teams are watching. Government institutions in the Netherlands and Finland have taken some of their websites offline as a precaution. What PHP2Shell is and why […]

The post PHP2Shell Update: One in ten organizations impacted as Europe bears the brunt appeared first on Check Point Blog.

Key takeaways Only 14 percent of organizations say they have formal GenAI policies that are actively enforced and audited, according to Check Point’s 2026 Cloud Security Report. →The costliest AI mistakes break rules no vendor ships. Air Canada was held liable for a refund its chatbot promised and the airline never offered →The usual fixes fall short. Models can be argued out of system prompts, keyword lists miss meaning, and US-centric DLP lists miss the data your regulators protect →Custom guardrails turn a sentence into an enforced rule. Describe it, test it in under five minutes, and run it on […]

The post Custom Guardrails: The AI Rules No Vendor Can Write for You appeared first on Check Point Blog.

Initially published Oct 21st at 6 AM PT- last updated 8:40AM PT Patch Now: Ensure you are up to date with the latest version IPS protection- CPAI-2026-15172 – Check Point Software. PHP Remote Code Execution (CVE-2026-109618, CVE-2026-109619). Check Point WAF protects against this threat How does Check Point protect you? Check Point Intrusion Prevention System (IPS):  IPS protection was just released to active this evening – PHP Remote Code Execution (CVE-2026-109618, CVE-2026-109619).  Always  Make sure gateways pull IPS updates automatically and set new critical protections to Prevent, not Detect. Watch Check Point Advisories for a new CPAI entry covering these […]

The post PHP2Shell: Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) appeared first on Check Point Blog.