Ivanti Connect Secure: Active Exploitation of Two Zero-Days Added to CISA KEV

Defenders must prioritize Ivanti Connect Secure due to active exploitation of two zero-days enabling unauthenticated RCE. Additionally, address the critical RCE in GitLab's CI/CD regex compiler. Review exposure on Danfoss refrigeration controllers.

Threat level high

Today in 60 seconds

Critical·KEV·CVSS 8.8·6 outlets Ivanti Connect Secure: Active Exploitation of Two Zero-Days Added to CISA KEV Active exploitation of two vulnerabilities in Ivanti Connect Secure allows unauthenticated RCE. Do this today Patch Ivanti Connect Secure devices immediately.
High·CVSS 10.0·3 outlets GitLab: Critical RCE in CI/CD Regex Compiler (CVE-2026-97229) Unauthenticated RCE exists in GitLab's CI/CD regex compiler; upgrade self-managed instances immediately. Do this today Upgrade self-managed GitLab CE or EE to version 19.4.2, 19.3.5, or 19.2.8.
High·7 outlets Danfoss Refrigeration Controllers Targeted in Supermarket Cyberattack Attackers remotely triggered defrost cycles on refrigeration controllers at French supermarkets.

Actively Exploited 4

Ivanti Connect Secure: Active Exploitation of Two Zero-Days Added to CISA KEV Critical·KEV·CVSS 8.8·6 outlets·CISANewRead Active exploitation of two vulnerabilities in Ivanti Connect Secure allows unauthenticated RCE.
CISA added CVE-2026-96951 and CVE-2026-104935 to the Known Exploited Vulnerabilities Catalog. These vulnerabilities relate to Microsoft Windows Command Injection and Ivanti Connect Secure Authentication Bypass by Spoofing, respectively.

Why it matters. Exploitation allows unauthenticated remote code execution on Ivanti Connect Secure devices. Federal agencies are required to prioritize remediation of KEV Catalog vulnerabilities on publicly exposed assets.

Do this today Patch Ivanti Connect Secure devices immediately.

Affected
Ivanti Connect Secure VPN devices

CVE
CVE-2026-104935, CVE-2026-96951

Read on CISA Post on X LinkedIn

Also covered by Volexity, BleepingComputer
```
{"coverage":1,"evidence":1,"freshness":0.697,"importance":1,"novelty":1,"quality":0.95,"total":0.965}
```
SonicWall SMA1000: Unauthenticated SSRF Flaw Exploited Critical·Exploited·CVSS 10.0·6 outlets·BleepingComputerDay 3NewRead Attackers are exploiting a maximum-severity, unauthenticated SSRF flaw in the SMA1000 Appliance WorkPlace interface.
Exploitation attempts targeting CVE-2026-102255 have been detected against SonicWall SMA1000 appliances. The flaw allows a remote unauthenticated attacker to perform unauthorized operations via the Appliance WorkPlace interface. The vulnerability was patched prior to detection of exploitation attempts.

Why it matters. This SSRF flaw could allow attackers to direct the appliance to issue requests on their behalf, potentially accessing internal functionality. SMA1000 devices are frequently targeted by MSSPs and large corporations for VPN access.

Do this today Patch SonicWall SMA1000 appliances against CVE-2026-102255.

Affected
SMA1000 6210, 7210, and 8200v models

CVE
CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, +1 more
1. Sat 10 OctSonicWall SMA1000: Max Severity SSRF Flaw (CVE-2026-102255)
2. Tue 13 OctSonicWall SMA1000: Unauthenticated SSRF Flaw (CVE-2026-102255) Exploited
3. TodaySonicWall SMA1000: Unauthenticated SSRF Flaw Exploited
Read on BleepingComputer Post on X LinkedIn

Also covered by SecurityWeek, Dark Reading
```
{"coverage":1,"evidence":0.9,"freshness":0.014,"importance":1,"novelty":0.6,"quality":0.95,"total":0.831}
```
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, including zero-days Critical·Exploited·BleepingComputerNewRead Microsoft released updates addressing 1,411 flaws, including one actively exploited and two publicly disclosed zero-days.
Microsoft released security updates addressing 1,411 flaws, including three zero-day vulnerabilities. One actively exploited zero-day allowed bypassing the Mark of the Web security feature via command injection. Another zero-day allowed bypassing Windows Defender Application Control in the .NET Framework.

Why it matters. The update addresses multiple critical flaws, including remote code execution vectors, requiring immediate patching to mitigate active exploitation risks.

Do this today Apply the October 2026 security updates from Microsoft.

Affected
Windows 11, version 24H2 Home and Pro; Windows 10 Enterprise LTSB 2016

Read on BleepingComputer Post on X LinkedIn

Also covered by Dark Reading
```
{"coverage":0.613,"evidence":0.9,"freshness":0.868,"importance":0.75,"novelty":1,"quality":0.95,"total":0.824}
```
npm Trusted Publishing Flaw Exposed Over 1,500 Packages to Hijacking Critical·Exploited·3 outlets·CSO OnlineNewRead A flaw in npm's Trusted Publishing mechanism allowed package hijacking via abandoned GitHub repository names.
The vulnerability allowed attackers to publish malicious updates to legitimate packages by reclaiming abandoned GitHub repository names. This occurred because npm relied on human-readable repository names instead of permanent numeric identifiers for trust verification. The npm team shipped a fix introducing a 48-hour expiry for unvalidated Trusted Publishing configurations.

Why it matters. This flaw presents a supply-chain risk, as malicious packages could be introduced without compromising developer credentials. AI coding agents increase the risk by automating dependency selection and installation.

Do this today Maintainers should audit Trusted Publishing configurations to verify repository names resolve to owned repositories and recreate bindings as necessary.

Affected
npm packages

Read on CSO Online Post on X LinkedIn

Also covered by The Hacker News, GBHackers
```
{"coverage":0.774,"evidence":0.9,"freshness":0.66,"importance":0.75,"novelty":1,"quality":0.8,"total":0.812}
```

Vulnerabilities & Patches 4

GitLab: Critical RCE in CI/CD Regex Compiler (CVE-2026-97229) High·CVSS 10.0·3 outlets·Rapid7NewRead Unauthenticated RCE exists in GitLab's CI/CD regex compiler; upgrade self-managed instances immediately.
GitLab released a patch for CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler. This flaw could allow arbitrary code execution on affected servers.

Why it matters. The vulnerability carries a CVSS score of 10.0. Exploitation requires an attacker to plant a malicious CI/CD configuration, but this constraint is removed if new users can self-register projects.

Do this today Upgrade self-managed GitLab CE or EE to version 19.4.2, 19.3.5, or 19.2.8.

Affected
Self-managed GitLab instances

CVE
CVE-2026-97229

Read on Rapid7 Post on X LinkedIn

Also covered by CSO Online, GBHackers
```
{"coverage":0.774,"evidence":0.7,"freshness":0.587,"importance":0.75,"novelty":1,"quality":0.85,"total":0.76}
```
Ghostscript Heap Overflow Allows RCE via Crafted PDF Files (CVE-2026-39919) High·CVSS 9.8·BleepingComputerNewRead A heap buffer overflow in Ghostscript enables unauthenticated remote code execution via malicious PDF uploads.
A heap buffer overflow vulnerability (CVE-2026-39919) exists in the Ghostscript interpreter and rendering engine. This flaw can be triggered by a specially crafted PDF containing a JPEG 2000 image. Successful exploitation can lead to unauthenticated remote code execution.

Why it matters. Any application processing attacker-supplied PDFs through vulnerable Ghostscript code is at risk. Exploitation requires the ability to upload the PDF and process it for preview or thumbnail generation.

Do this today Upgrade Ghostscript to version 10.08.0 or later, or block PDF uploads/disable PDF rendering in ImageMagick.

Affected
Ghostscript 9.21 through 10.07.1

CVE
CVE-2026-39919

Read on BleepingComputer Post on X LinkedIn

Also covered by GBHackers
```
{"coverage":0.613,"evidence":0.7,"freshness":0.671,"importance":0.75,"novelty":1,"quality":0.95,"total":0.754}
```
Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572) High·CVSS 8.8·Embrace The RedNewRead Path validation bypass in Copilot allows arbitrary command execution in Visual Studio and SSMS.
A vulnerability in Visual Studio Copilot allows bypassing path validation checks. This permits writing to configuration files and achieving arbitrary command execution within Visual Studio and SSMS.

Why it matters. Exploitation can modify settings to execute malicious commands or overwrite paths to launch arbitrary binaries when Copilot performs actions.

Affected
Visual Studio, SQL Server Management Studio (SSMS)

CVE
CVE-2026-103572

Read on Embrace The Red Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.4,"freshness":0.92,"importance":0.75,"novelty":1,"quality":0.9,"total":0.665}
```
LiteLLM: Multiple Vulnerabilities Found in LLM Gateway High·CVSS 8.8·Check Point ResearchNewRead LiteLLM has multiple high-impact vulnerabilities, including RCE and SSRF, resolved in version 1.83.9.
Check Point Research identified vulnerabilities in LiteLLM, specifically concerning a missing authorization check on the /config/update endpoint. This flaw allowed authenticated users to execute arbitrary file reads, take over administrative accounts, and achieve remote code execution. A separate SSRF vulnerability was also found in the credentials feature.

Why it matters. Defenders using LiteLLM as an LLM gateway face risks including unauthorized configuration changes and potential remote code execution if running vulnerable versions.

Do this today Upgrade LiteLLM to version 1.83.9 or later.

Affected
LiteLLM versions prior to 1.83.9

CVE
CVE-2026-35029, CVE-2026-59823

Read on Check Point Research Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.4,"freshness":0.747,"importance":0.75,"novelty":1,"quality":0.9,"total":0.648}
```

Worth watching

Exploitation Steam Local Privilege Escalation John Hammond · 13 Oct
Walkthrough Team Introduction Videos for the European Cyber Security Challenge LiveOverflow · 13 Oct
Walkthrough HackTheBox - DevHub IppSec · 10 Oct

Malware & Ransomware 1

Ledger Signer Hardware Implant Linked to Crypto Heist High·SecurityWeekNewRead A hardware implant in Ledger signers was used to read and transmit user data during a large crypto heist.
A small circuit board was found hidden under the signers' screens. This implant was capable of reading user data and transmitting it to attackers. The activity was linked to an $86 million crypto heist.

Why it matters. This indicates a physical compromise vector for sensitive cryptographic material. Users should assume potential exposure of private keys if the device was compromised.

Affected
Ledger signers

Read on SecurityWeek Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.67,"importance":0.75,"novelty":1,"quality":0.9,"total":0.54}
```

Threat Actors & Campaigns 3

Danfoss Refrigeration Controllers Targeted in Supermarket Cyberattack High·7 outlets·The RecordDay 2NewRead Attackers remotely triggered defrost cycles on refrigeration controllers at French supermarkets.
A cyberattack disrupted refrigeration units at French supermarkets by remotely triggering the defrost function. The attack reportedly targeted Danfoss refrigeration controllers, specifically older versions of the software.

Why it matters. This demonstrates the potential for physical disruption and food spoilage via industrial control system compromise.

Affected
Danfoss refrigeration controllers
1. Tue 13 OctDanfoss Refrigeration Controllers Targeted in French Supermarket Cyberattack
2. TodayDanfoss Refrigeration Controllers Targeted in Supermarket Cyberattack
Read on The Record Post on X LinkedIn

Also covered by BleepingComputer, SecurityWeek
```
{"coverage":1,"evidence":0,"freshness":0.249,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.555}
```
Unit 42 Analysis: Third-Party Risk via Weak Authentication Medium·Unit 42NewRead An opportunistic attacker breached a bank using weak third-party gateway authentication and credential abuse.
An attacker gained unauthorized VPN access to a European bank's central IT system using compromised credentials. The actor conducted extensive network scanning and brute-force password guessing against internal systems.

Why it matters. The attack demonstrated that foundational security gaps, such as missing MFA or unpatched edge devices, are sufficient for significant intrusion. Opportunistic actors exploit simple oversights rather than requiring advanced techniques.

Do this today Enforce multi-factor authentication on all VPN access points.

Read on Unit 42 Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.92,"importance":0.5,"novelty":1,"quality":0.95,"total":0.495}
```
DOJ Raids Target Laptop Farms Funding North Korea Medium·The RecordNewRead DOJ arrested individuals involved in laptop farms used by North Korea to generate revenue from U.S. companies.
The Department of Justice conducted raids targeting over 40 residences in Texas allegedly used by North Korean nationals for an IT worker scheme. Law enforcement seized 187 laptops and other devices during the operation.

Why it matters. These schemes allow North Korea to generate revenue by tricking U.S. companies into hiring workers remotely using stolen or purchased identities. This activity threatens the security of U.S. employer data and involves identity theft.

Read on The Record Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.892,"importance":0.5,"novelty":1,"quality":0.95,"total":0.492}
```

Research & Techniques 1

FTC Charges Ohio Company for Sextortion Scam Services Info·The RecordNewRead FTC charged an Ohio company for fraudulently charging victims for non-existent sextortion protection services.
An Ohio-based company allegedly collected at least $60 million by selling fraudulent sextortion assistance services. The company allegedly fabricated evidence and failed to provide any of the advertised support to victims.

Why it matters. This case demonstrates tactics used by criminal operations targeting victims of digital extortion threats. Defenders should be aware of social engineering vectors related to sensitive personal data threats.

Read on The Record Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.875,"importance":0.5,"novelty":1,"quality":0.95,"total":0.491}
```

Policy, Law & Arrests 2

Xandr Fined for Sharing Sensitive Grindr User Data via Ad Auctions Info·MalwarebytesNewRead Xandr was fined for illegally sharing sensitive Grindr user data, potentially revealing sexual orientation, through ad auctions.
The Norwegian Data Protection Authority fined Xandr for unlawfully processing and sharing sensitive information concerning Grindr users. This data was exposed through real-time advertising auctions between July 2018 and April 2020. The regulator found Xandr failed to verify valid consent for this data sharing.

Why it matters. This demonstrates that sensitive personal information can be exposed through ad technology systems without direct hacking or explicit user disclosure. Data sharing practices can create profiles based on service usage itself.

Do this today Review location permissions and advertising settings on all personal applications.

Affected
Grindr users

Read on Malwarebytes Post on X LinkedIn

Also covered by The Hacker News
```
{"coverage":0.613,"evidence":0,"freshness":0.716,"importance":0.5,"novelty":1,"quality":0.85,"total":0.499}
```
DOJ Charges Individuals in North Korean Remote Work Scheme Info·CyberScoopNewRead DOJ charged 14 individuals in an operation disrupting a North Korean scheme using stolen identities for remote work.
Federal authorities charged 14 people in an operation targeting a North Korean remote IT worker scheme. The operation uncovered activities using stolen identities to funnel funds from U.S. employers to Pyongyang.

Why it matters. This indicates a persistent threat vector where hostile foreign regimes exploit U.S. businesses via stolen identities and covert access points.

Read on CyberScoop Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.913,"importance":0.5,"novelty":1,"quality":0.9,"total":0.489}
```

CVE spotlight

CVE	Affects	CVSS	EPSS	Status
CVE-2026-96951	Microsoft WindowsImproper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypa…	8.8	—	Exploited (KEV)CISA due 16 Oct
CVE-2026-104935	Ivanti Connect SecureAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. Thi…	8.6	—	Exploited (KEV)CISA due 16 Oct
CVE-2026-35029	litellmLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not …	8.8	4%	Not in KEV
CVE-2026-39919	—Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that a…	9.8	1%	Not in KEV
CVE-2026-102257	—A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the …	7.2	1%	Not in KEV
CVE-2026-102256	—Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identi…	7.8	0%	Not in KEV

Quiz

Yesterday's answer

According to the security advisory, what is the primary impact of exploiting CVE-2026-85097 in the Bricksforge Plugin?

Allows unauthenticated users to upload and execute arbitrary PHP code.

The story explicitly states that the vulnerability allows unauthenticated users to upload and execute arbitrary PHP code.

Today's question

According to the CISA advisory, which vulnerability added to the KEV catalog relates to Microsoft Windows Command Injection?

On the radar tomorrow

KEV deadline Fri 16 OctCVE-2026-104935 · Ivanti Connect Secure
KEV deadline Fri 16 OctCVE-2026-96951 · Microsoft Windows
WatchingAnthropic warns self-replicating AI could spread to your smart devices
WatchingLow-cost Android phones ship with residential proxy malware

Also worth your time

Exploits

Teltonika_RutOS 00.07.06.21 - command injectionRemote
TigerGraph_Community_Edition 4.2.4 - arbitrary file writeWebApps
WordPress 7.0.2 - Path TravesalWebApps
Food-Ordering 1.0 - LFIWebApps
Ecava_ntegraXor IGX_16.0.701.10 - RCERemote

Tools

Infisical/infisical★ 29742 · TypeScriptInfisical is the open-source platform for securing secrets, certificates, access, and AI Agents.
jiwoochris/artex-global★ 1438 · GoARTEX 한국어판 · AI 자율 침투 테스트 프레임워크(upstream: Autumn-27/ARTEX, AGPL-3.0)
xalgorix/xalgorix★ 1203 · GoAutonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go …
HaxL0p4/L0p4Map★ 985 · PythonProfessional network monitoring & visualization tool. L0P4Map combines high-speed ARP discovery with full nmap integrati…
Zyrexnn/Cybermes★ 935 · PythonAutonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework powered by Hermes Agent, specialized reasoning s…
Unclecheng-li/poc-lab★ 812 · CRecent CVE PoC & reproduction scripts. Focused on high-severity vulnerabilities across Linux kernel, Windows, macOS and …

Community

Podcasts

180: ContiDarknet Diaries · 59:17
Soap Box: HD Moore talks OT security, frontier fearmongering and moreRisky Business · 34:01
SN 1099: An Alien Mind - From RSA Weakness to Agentic AttacksSecurity Now · 3:03:15
SANS Stormcast Tuesday, October 13th, 2026: GitLab CI/CD RCE (CVE-2026-97229); Let’s Encrypt 64-Day Certificates; Midnight Mimosa Pre-Installed Android Malware; Progress MarkLogic PatchesSANS Internet Storm Center · 5:38

That's today's brief.

The next brief lands at 06:30 IST.

Wednesday, 14 October 2026