Weekly Cyber Security Newsletter Bulletin – Certighost Exploit, Checkpoint 0-day, HTTP/2 Flaw, Notepad++ Plugin Abuse +20 Stories

Threat actors continued to combine classic exploitation techniques with AI-accelerated tooling this week, from a 15-year-old NGINX bug and an actively exploited Check Point authentication flaw to autonomous AI agents chaining zero-days against Hugging Face. Below is a roundup of 18 major stories covering ransomware, AI security, kernel vulnerabilities, cloud/SaaS abuse, and critical infrastructure flaws. A newly disclosed Active Directory Certificate Services vulnerability dubbed Certighost, tracked as CVE-2026-54121, let a low-privilege domain user impersonate a Domain Controller and take over an entire AD domain. The flaw exploited a “chase” lookup process in certificate enrollment where the CA trusted an attacker-supplied host (cdc parameter) without verifying it was a genuine Domain Controller, allowing a rogue machine account to pass authentication checks as a “valid” domain principal. Combined with the default ms-DS-MachineAccountQuota setting that lets any user register machine accounts, an attacker could get a certificate issued carrying an impersonated DC’s identity, then perform a DCSync attack to extract the krbtgt hash and seize full domain control. Microsoft patched the issue in its July 2026 updates with a new validation function, and organizations unable to patch immediately can disable the vulnerable chase fallback via EDITF_ENABLECHASECLIENTDC as a temporary mitigation. CISA issued an…