The vulnerabilities that matter most in 2026 are increasingly the ones that are not patched, because they are not flaws at all. Two of the recent intrusion stories logged on this beat follow the same shape: a vulnerability that clears the way, followed by a mechanism that keeps the attacker inside after the way has been closed. A third story, smaller in stakes, shows the same logic operating on consumer hardware, where a firmware patch can turn a device into something its maker never sold. The pattern is that initial access is becoming the cheap part of an intrusion, and persistence is becoming the product.
Two Stages, One Intrusion
Check Point's emergency hotfixes address a high-severity flaw that has been exploited since late October to gain root privileges and establish persistence on vulnerable devices, as BleepingComputer reported. The second story, also from BleepingComputer, is the more instructive one: multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to keep access to Linux servers even after the vulnerabilities used to get in have been patched.
Read together, they describe a division of labor. The flaw gets the attacker through the door; the tooling is what keeps a key. Patching closes the initial vector and leaves the second stage untouched. That is not a failure of patching, which remains the correct response. It is a failure to treat remediation as a complete act rather than a partial one.
The Legitimate Tool Problem
GSocket is not malware in origin. It is an open-source remote access tool, and that is precisely what makes it useful to an intruder. Security tooling that is legitimate, documented and widely available does not trip the signature-based defenses that many organizations still lean on, and it does not require the attacker to write anything. Abusing it costs almost nothing.
The practical consequence for defenders is that the presence of a remote access tool on a Linux server is no longer a self-evident signal of anything. Inventories of approved software become more important than blocklists, because the thing to detect is not the tool but the tool where it does not belong. That is a harder detection problem, and it is the one the GSocket cases set.
Root Access as an Outcome
The Check Point case puts the same idea in starker terms. The flaw yields root privileges and persistence, which means the attacker does not merely read data but owns the device. Once root is achieved, the integrity of everything the device reports about itself is in question, including the logs that an incident response team would rely on. Emergency hotfixes can close the flaw; they cannot undo what was done while it was open.
This is why the timing matters. Exploitation dating to late October means a window in which compromise could have occurred before any fix existed. Organizations that apply the hotfix and stop there have closed a door without checking whether anyone came through it.
