Check Point VPN and Google Chrome Vulnerabilities Under Active Exploitation

Posted by Steve Alder

Patches have been issued to fix a critical vulnerability affecting Check Point Mobile Access, SSL VPN, Remote Access VPN, and Spark Firewalls, and a high-severity vulnerability in Google Chrome, both of which are being actively exploited in the wild.

Check Point Remote Access VPN Vulnerability

On June 8, 2026, the cybersecurity firm Check Point issued a security advisory about a critical authentication bypass vulnerability tracked as CVE-2026-50751 (CVSS 9.3), which has been actively exploited in zero-day attacks since May 7, 2026. Exploitation of the vulnerability accelerated over the weekend, with a few dozen organizations falling victim to attacks. In one attack, Check Point associated the post-exploit activity with a Qilin ransomware affiliate that has previously targeted vulnerabilities in other VPNs.

The vulnerability affects Check Point Mobile Access, SSL VPN, Remote Access VPN, and Spark Firewalls; however, only if deployments are configured to use the deprecated IKEv1 key exchange protocol. In vulnerable deployments, unauthenticated remote attackers can exploit a logic flaw in certificate validation, which allows them to establish a VPN connection without a valid password, bypassing authentication requirements.

Check Point also identified a second vulnerability while investigating the actively exploited zero day. The vulnerability is also associated with the deprecated IKEv1 key exchange, which can allow a man-in-the-middle attack on VPN site-to-site connections. The vulnerability is tracked as CVE-2026-50752, has a CVSS score of 7.4, and affects Security Gateways and Spark Firewalls. At the time of issuing the patch, there had been no known exploitation of the flaw.

Customers using the IKEv1 key exchange protocol have been advised to apply the security updates as soon as possible. If the hotfixes cannot be immediately applied, users should follow Check Point’s mitigation guidance detailed in the security alert. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerability (KEV) Catalog and ordered all government agencies to secure their deployments by applying the security updates or mitigations within 3 days. or to discontinue use of the product.

Google Chrome Zero-day

Google has released an emergency patch to fix an actively exploited high-severity zero-day vulnerability in Google Chrome. The vulnerability, tracked as CVE-2026-11645, is due to an out-of-bounds read and write flaw in the Chrome V8 JavaScript engine. The vulnerability can be exploited by a remote attacker via specially crafted HTML pages. Successful exploitation allows the attacker to execute arbitrary code inside the web browser sandbox, exposing sensitive information or crashing Chrome.

Google is aware of an exploit for the vulnerability in the wild, and has rolled out updates for users in the Stable Desktop channel for Windows, Mac, and Linux Systems. Further information about the bug is being withheld until the majority of users have updated Chrome.

The post Check Point VPN and Google Chrome Vulnerabilities Under Active Exploitation appeared first on The HIPAA Journal.

Senator Seeks Answers from NYC Health & Hospitals About 1.8M Record Breach

Posted by Steve Alder

The Senate Health, Education, Labor, and Pensions (HELP) Committee Chair Senator Bill Cassidy, M.D. (R-LA), is seeking answers from NYC Health + Hospitals about the steps that have been taken since its recent data breach to improve its security protocols to prevent further cybersecurity incidents and breaches of patient data.

NYC Health + Hospitals discovered suspicious activity within its computer systems on February 2, 2026, with its investigation determining that its systems were accessed by an unauthorized third party for almost three months before the intrusion was detected. The threat actor first accessed its system on February 25, 2026, and retained access until February 11, 2026. The investigation suggests access was gained via a third-party vendor. Data compromised in the incident included names, Social Security numbers, medical information, health insurance information, billing and claims information, payment information, and precise geolocation data. The data breach was reported to the HHS’ Office for Civil Rights as affecting 1.8 million individuals.

In the letter to NYC Health + Hospitals CEO Mitchell Katz and CC’d to NYC Mayor Zohran Mamdani, Sen. Cassidy pointed out that healthcare data breaches are being reported in high numbers. Currently, 772 large healthcare data breaches are listed on the OCR data breach portal, making 2025 a record year for healthcare data breaches. These incidents result in delayed care, and data theft puts patients at risk of identity theft and fraud. NYC Health + Hospitals is the largest public health system in the United States, providing care to 1 million patients a year, and its data breach has created a substantial risk to the population it serves.

Sen. Cassidy seeks answers on both the cybersecurity controls in place prior to the cybersecurity incident and the measures implemented post-incident to protect against further cyberattacks. Specifically, Sen. Cassidy wants answers about the cyber and physical security protocols in place to protect against cyberattacks, how cybersecurity best practices implemented by other critical infrastructure sectors have been incorporated into its security policies and protocols, exactly when it became aware of an intrusion, when and which federal agencies were notified about the incident, and the remedial steps taken to improve security protocols.

Sen Cassidy also wants more detail about the steps taken to identify any additional information that may have been accessed in the attack, how it is proactively communicating with potentially impacted individuals and entities, and what additional reporting it will commit to doing for the affected individuals, beyond the reporting requirements of HIPAA. Sen. Cassidy is seeking a response to the questions no later than June 18, 2026.

Sen. Cassidy is taking a keen interest in cybersecurity incidents at healthcare organizations. He sent a similar letter to Aflac following its massive data breach in 2025 – the second-largest healthcare data breach of the year, affecting almost 14 million individuals – and UnitedHealth Group following the Change Healthcare cyberattack in 2024.

Sen Cassidy, along with Sens. Maggie Hassan (D-NH), Mark Warner (D-VA), and John Cornyn (R-TX) reintroduced the Health Care Cybersecurity and Resiliency Act last year, which was advanced by the HELP committee this Spring, in an attempt to strengthen healthcare cybersecurity and improve resiliency against ever-increasing healthcare cyberattacks and data breaches.

The post Senator Seeks Answers from NYC Health & Hospitals About 1.8M Record Breach appeared first on The HIPAA Journal.