[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

official IOCs (Check Point security advisory, Nov 12, 2026)

Hunting the Check Point gateway intrusions: upload_progress_pwn session files, fake CPconfigdaemon, 'Dream Annexation' note

  • Check: PHP session storage on Mobile Access gateways for upload_progress_pwn; process lists and binaries for CPconfigdaemon lookalikes; /tmp and /temp for scanner/wiper files.
  • Logs: look for connections from the two 130.94.19.x addresses since Oct 30 and for logging gaps after daemon crashes.
  • Caveat: Check Point says no match doesn't rule out compromise; any match needs immediate investigation.

Sources: Check Point blog: Security Advisory: Active Exploitation of PHP2Shell and Local Privilege Escalation (Nov 12, 2026)