Two firewall holes, one already used

Every good trick works because you are watching the wrong hand.

Two of the biggest firewall makers both have a hole that needs no password at all. One of them is still a warning. The other is already being used to deliver…

• Check Point: two flaws, CVE-2026-85102 and CVE-2026-85103, both scoring 9.8 out of 10. An attacker needs no password and no login. Getting in is the whole vulnerability. Fixes have existed since 7 September, as LivePatch Take 24 or a Jumbo Hotfix depending on your version.
• Nobody has been caught using the Check Point flaws yet, and that is the window that matters. The Dutch national cyber agency, NCSC, is not waiting for proof. It says an unpatched system could be taken over completely and expects that to start soon. A flaw with no working public exploit is the easiest one to close before it becomes one.
• Cisco is the other half, and it is past the warning stage. On 10 September Cisco confirmed attackers were already inside its Secure Firewall Management Center. CVE-2026-20079 scores the maximum 10 out of 10 and lets someone log in as administrator with no password. CVE-2026-20316 is smaller alone but chains with it.

BleepingComputer: Dutch NCSC warns Check Point VPN flaws exploitation is imminent → https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/

Worry about the quiet supplier

Check Point went looking inside its own product, found the hole above, and told everybody.

Nobody made them do that. They could have folded the fix quietly into the next release and none of us would ever have known.

Patient files stolen from a GP practice

Not every disappearing act happens on a stage.

A doctor's practice in Gouda, just over the Dutch border, had patient files stolen this week.

• The stolen data includes names, birth dates, addresses, phone numbers, and for some patients their national identification number. That last one, the BSN in the Netherlands, is the same kind of number as the Belgian rijksregisternummer: hard to change, and useful for identity fraud for years.
• The ransomware group LockBit5 claimed responsibility and has already published stolen documents online. How the attackers got in was not made public.
• No new Belgian company appeared on a public ransomware leak site this week, the third week running. We checked the tracker rather than assumed: 178 Belgian organisations logged in total, and the newest entry is still takt.be on 27 August. Three quiet weeks are real, and they still are not proof that nothing is happening quietly.

Security.NL: patient data stolen in hack of Gouda GP practice (Dutch) → https://www.security.nl/posting/952637/Medische+gegevens+pati%C3%ABnten+buitgemaakt+bij+hack+van+Goudse+huisartsen

We build your compliance report for you

No smoke, no mirrors, just the paperwork.

An auditor's first question is usually the same one: show me your Statement of Applicability.

• One document, not a folder. Every control you are in scope for, its status, and the evidence behind it, laid out the way an assessor actually reads it.
• Your risk register now draws from every framework you are active on, not just your main one. If a client questionnaire asks a GDPR question and you only run CyFun, that question is now answered from the same register instead of a second spreadsheet.
• Every risk now shows which controls are supposed to treat it, and whether they actually hold. Until this month a control could read as covered here with nothing behind it. We shipped that fix on 11 September, and this is the same honesty applied to risk.

Try it now → https://easycyberprotection.com/start