CISA Adds Multiple Vulnerabilities to KEV Catalog: Ivanti, GitLab, Cisco

Critical·KEV·CVSS 10.0·EPSS 27%·5 outletsNew CISA Adds Multiple Vulnerabilities to KEV Catalog: Ivanti, GitLab, Cisco CISA added multiple vulnerabilities in Ivanti, GitLab, and Cisco to the KEV Catalog due to active exploitation. Do this today Review asset exposure and prioritize patching for all CVEs listed in the CISA KEV Catalog. Read the full story ↓
Medium·PoC publicNew Android SMS of Death Exploit (CVE-2026-58882) Allows Remote Service Disruption A PoC exploit for CVE-2026-58882 lets attackers remotely crash phones and disrupt service via SMS. Do this today Install the latest Android security updates for affected devices. Read the full story ↓
HighNew Chainalysis Discloses Data Breach from Offensive Agentic Techniques Chainalysis experienced a breach exposing customer names, emails, and user IDs via offensive agentic techniques. Do this today Enable two-factor authentication (2FA) and watch for unexpected password reset requests or authentication prompts. Read the full story ↓

From the editor

Defenders must prioritize patching Ivanti, GitLab, and Cisco due to their inclusion in the CISA KEV Catalog. Additionally, address the remote service disruption risk posed by the Android SMS of Death exploit. Review access controls following the Chainalysis data breach.

Anmol Singh YadavEditor, PwnSpectrum

Actively Exploited 4

CISA Adds Multiple Vulnerabilities to KEV Catalog: Ivanti, GitLab, Cisco Critical·KEV·CVSS 10.0·EPSS 27%·5 outlets·CISADay 2NewRead CISA added multiple vulnerabilities in Ivanti, GitLab, and Cisco to the KEV Catalog due to active exploitation.
CISA added CVE-2026-111357 (Ivanti), CVE-2026-118527 (Ivanti), CVE-2026-97229 (GitLab), and CVE-2026-76418 (Cisco) to the Known Exploited Vulnerabilities Catalog. These vulnerabilities involve issues such as missing authentication, predictable identifiers, and unchecked return values.

Why it matters. Active exploitation of these vulnerabilities presents significant risk, requiring immediate attention to prevent unauthorized control of exposed assets.

Do this today Review asset exposure and prioritize patching for all CVEs listed in the CISA KEV Catalog.

Affected
Ivanti Connect Secure, GitLab Community Edition, GitLab Enterprise Edition, Cisco Secure Firewall ASA Software, Cisco Secure FTD Software

CVE
CVE-2026-111357, CVE-2026-118527, CVE-2026-97229
1. Sat 31 OctCISA Adds Multiple Vulnerabilities to Known Exploited Catalog
2. TodayCISA Adds Multiple Vulnerabilities to KEV Catalog: Ivanti, GitLab, Cisco
Read on CISA Post on X LinkedIn

Also covered by BleepingComputer
```
{"coverage":1,"evidence":1,"freshness":0.131,"importance":1,"novelty":0.6,"quality":0.95,"total":0.868}
```
PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Allow RCE Critical·KEV·PoC public·CVSS 9.8·EPSS 100%·24 outlets·Fortinet PSIRTDay 10NewRead Two critical PHP vulnerabilities allow unauthenticated remote code execution via memory handling flaws.
CVE-2026-109618 allows RCE by triggering conditions during out-of-memory error handling. CVE-2026-109619 enables RCE due to improperly reset global state referencing freed memory.

Why it matters. These vulnerabilities impact all PHP installations serving web requests, leading to unauthenticated remote code execution. Prioritize patching internet-facing systems immediately.

Do this today Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately.

Affected
All PHP installations serving web requests

CVE
CVE-2026-109618, CVE-2026-109619, CVE-2026-115560
1. Thu 22 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
2. Fri 23 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
3. Sat 24 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
4. Mon 26 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
5. Tue 27 OctPHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Allow RCE
6. Wed 28 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
7. Thu 29 OctPHP RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
8. Fri 30 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
9. Sat 31 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
10. TodayPHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Allow RCE
Read on Fortinet PSIRT Post on X LinkedIn

Also covered by CISA, Unit 42
```
{"coverage":1,"evidence":1,"freshness":0.001,"importance":1,"novelty":0.6,"quality":0.95,"total":0.855}
```
CISA Adds Two Exploited Vulnerabilities: Broadcom VMWare ESX and Linux Kernel Critical·KEV·CVSS 7.8·EPSS 16%·5 outlets·CISADay 2NewRead CISA added CVE-2026-41709 and CVE-2026-46300 to the KEV Catalog due to active exploitation.
CISA added CVE-2026-41709, an insufficient logging vulnerability in Broadcom VMWare ESX, and CVE-2026-46300, a Linux Kernel variable initialization flaw, to the KEV Catalog. Evidence indicates active exploitation of these vulnerabilities.

Why it matters. These vulnerabilities are frequently used attack vectors, and CISA advises all organizations to prioritize remediation of KEV Catalog items on publicly exposed assets.

Do this today Prioritize remediation for CVE-2026-41709 and CVE-2026-46300.

Affected
Broadcom VMWare ESX, Linux Kernel

CVE
CVE-2026-41709, CVE-2026-46300
1. Fri 30 OctCISA Adds Two Exploited Vulnerabilities to KEV Catalog
2. TodayCISA Adds Two Exploited Vulnerabilities: Broadcom VMWare ESX and Linux Kernel
Read on CISA Post on X LinkedIn

Also covered by SecurityWeek, The Hacker News
```
{"coverage":1,"evidence":1,"freshness":0.094,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.789}
```
Apple Backports CoreGraphics Zero-Day Fix for Older iOS Devices Critical·KEV·CVSS 8.8·EPSS 26%·5 outlets·Malwarebytes via BleepingComputerDay 2NewRead Apple issued patches for a CoreGraphics zero-day vulnerability, CVE-2026-86950, affecting older iPhones and iPads.
Apple backported a security patch addressing an out-of-bounds write weakness in CoreGraphics, tracked as CVE-2026-86950. This flaw was reportedly exploited in targeted attacks. The patch was applied to older devices alongside other security updates.

Why it matters. Exploitation of this vulnerability could allow attackers to gain remote code execution by processing a maliciously crafted file. Applying the patch mitigates this risk on supported older hardware.

Do this today Install the latest iOS/iPadOS security updates provided by Apple.

Affected
iPhone XS, XS Max, XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, iPad mini 6th generation and later

CVE
CVE-2026-86950
1. Wed 28 OctApple Backports CoreGraphics Zero-Day Patch for Older iOS Devices
2. TodayApple Backports CoreGraphics Zero-Day Fix for Older iOS Devices
Read the original · Malwarebytes Post on X LinkedIn

Summarised from BleepingComputer; also covered by SecurityWeek, Malwarebytes.
```
{"coverage":1,"evidence":1,"freshness":0.047,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.785}
```

Based on the investigation to date, we have found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens

Chainalysis, via BleepingComputer

Vulnerabilities & Patches 4

Android SMS of Death Exploit (CVE-2026-58882) Allows Remote Service Disruption Medium·PoC public·Android via BleepingComputerNewRead A PoC exploit for CVE-2026-58882 lets attackers remotely crash phones and disrupt service via SMS.
A proof-of-concept exploit targets a vulnerability in Android's handling of WAP Push messages. Sending a specially crafted SMS can trigger a NegativeArraySizeException, crashing the com.android.phone process. This crash can disrupt cellular service and disconnect calls, including emergency calls.

Why it matters. The flaw allows for a zero-click denial-of-service condition without user interaction. Older Android versions, specifically 12 and 13, are noted as potentially vulnerable as the fix was not listed in the October security bulletin for those versions.

Do this today Install the latest Android security updates for affected devices.

Affected
Android 12, Android 13

CVE
CVE-2026-58882

Read the original · Android Post on X LinkedIn

Summarised from BleepingComputer; also covered by GBHackers.
```
{"coverage":0.613,"evidence":0.5,"freshness":0.296,"importance":0.5,"novelty":1,"quality":0.95,"total":0.592}
```
Linux Kernel IPv6 AH Routing Header Integer Underflow LPE Vulnerability High·CVSS 7.8·Zero Day InitiativeNewRead Local attackers can escalate privileges on Linux Kernel via an integer underflow in the IPv6 AH Routing Header.
An integer underflow vulnerability exists in the parsing of ipv6_rt_hdr headers within the Linux Kernel. Exploitation allows local attackers to escalate privileges and execute arbitrary code in kernel context.

Why it matters. Successful exploitation requires the attacker to first achieve low-privileged code execution on the target system. This vulnerability is associated with CVE-2026-80844.

Affected
Linux Kernel

CVE
CVE-2026-72315, CVE-2026-80844, CVE-2026-93826, +1 more

Read on Zero Day Initiative Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.4,"freshness":0.151,"importance":0.5,"novelty":1,"quality":0.9,"total":0.513}
```
MLflow: Multiple Deserialization RCE Vulnerabilities in Core Components High·CVSS 8.8·Zero Day InitiativeNewRead Multiple MLflow components allow unauthenticated RCE via deserialization of untrusted data requiring user interaction.
Multiple vulnerabilities were identified in MLflow components, including SHAP load_explainer, _load_model, and PickleEvaluationArtifact. These flaws allow remote code execution through deserialization of untrusted data.

Why it matters. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file, to execute code in the context of the current user.

Do this today Upgrade MLflow to version 3.15.0

Affected
MLflow

CVE
CVE-2024-37052, CVE-2026-118623, CVE-2026-118627

Read on Zero Day Initiative Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.4,"freshness":0.151,"importance":0.5,"novelty":1,"quality":0.9,"total":0.513}
```
FreeBSD Kernel TTY Race Condition Allows Local Privilege Escalation High·CVSS 7.0·Zero Day InitiativeNewRead A race condition in the FreeBSD Kernel's TTY component allows local attackers to escalate privileges.
A flaw in the TIOCSCTTY handler, caused by improper locking during object operations, creates a race condition. This vulnerability permits local attackers to escalate privileges and execute arbitrary code within the kernel context.

Why it matters. Successful exploitation allows an attacker who has already gained low-privileged code execution to achieve kernel-level control.

Do this today Apply the update detailed in FreeBSD-SA-26:62.tty.asc.

Affected
FreeBSD Kernel

CVE
CVE-2026-58093

Read on Zero Day Initiative Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.4,"freshness":0.151,"importance":0.5,"novelty":1,"quality":0.9,"total":0.513}
```

Malware & Ransomware 3

Unauthorized Codex/Claude Relays Disable Security Protections via CLI Manipulation High·Bloomberg via GBHackersNewRead Unauthorized relays are manipulating Codex and Claude Code CLIs to disable sandboxing and redirect API calls.
An unauthorized relay service installs legitimate OpenAI Codex and Anthropic Claude Code CLIs. This service then rewrites configuration files to disable sandboxing and set the sandbox mode to danger-full-access. The relay also points base URLs to relay-controlled servers and injects relay-issued API keys.

Why it matters. The relay intercepts all prompts, files, and secrets sent to the agents. With sandboxing disabled, a malicious response could execute with the user's full privileges.

Do this today Monitor endpoints for changes to base_url or ANTHROPIC_BASE_URL, the presence of danger-full-access in config.toml, or unapproved OPENAI_BASE_URL/ANTHROPIC_AUTH_TOKEN environment variables.

Read the original · Bloomberg Post on X LinkedIn

Summarised from GBHackers.
```
{"coverage":0.387,"evidence":0,"freshness":0.393,"importance":0.75,"novelty":1,"quality":0.65,"total":0.487}
```
GOLD OGRE Uses AI Agents for Automated Aur0ra Ransomware Operations High·Sophos via GBHackersNewRead Cybercrime group GOLD OGRE uses AI coding agents like Cursor and Claude for automated network intrusions.
The GOLD OGRE group utilized AI coding agents, including Cursor and Anthropic’s Claude, to automate intrusions for Aur0ra ransomware. These agents performed actions such as Active Directory discovery, password spraying, and credential extraction with minimal human intervention. The group also staged and exfiltrated data to S3-compatible storage.

Why it matters. The use of AI agents suggests a shift toward automated, sophisticated post-exploitation capabilities for ransomware groups. Defenders must assume automated lateral movement is possible.

Do this today Deploy phishing-resistant MFA, segment critical servers, and isolate backups.

Read the original · Sophos Post on X LinkedIn

Summarised from GBHackers.
```
{"coverage":0.387,"evidence":0,"freshness":0.384,"importance":0.75,"novelty":1,"quality":0.65,"total":0.486}
```
VOLTA Infostealer Uses LLMs for Model-Driven Victim Profiling Medium·Cisco TalosNewRead VOLTA stealer uses LLMs to profile victims, ranking assets by monetization value after credential theft.
The VOLTA infostealer steals credentials, sessions, and cryptocurrency wallets. It then sends a structured evidence bundle to an LLM to rank the victim’s assets by monetization value. This process involves live enrichment using stolen sessions to query services like Gmail and order history.

Why it matters. The stealer elevates commodity theft by using AI to create a prioritized, monetizable dossier of the victim, increasing the value of compromised credentials.

Read on Cisco Talos Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.697,"importance":0.5,"novelty":1,"quality":0.95,"total":0.473}
```

Threat Actors & Campaigns 3

Syrian Electronic Army Hacker Sentenced for Western Attacks Medium·3 outlets·The RecordNewRead A former Syrian Electronic Army member received a 42-month sentence for cyberattacks against Western targets.
Ahmad Umar Agha, known as “Th3Pr0,” was sentenced to 42 months in federal court for involvement in cyber campaigns organized by advisors to Bashar al-Assad. Agha was responsible for attacks against approximately 47 Western media outlets, non-profit groups, and other entities.

Why it matters. The case demonstrates the use of state-sponsored hacking groups to conduct disinformation campaigns and intelligence collection against foreign interests.

Read on The Record Post on X LinkedIn

Also covered by CyberScoop, SecurityWeek
```
{"coverage":0.774,"evidence":0,"freshness":0.382,"importance":0.5,"novelty":1,"quality":0.95,"total":0.499}
```
Japan Cyberattacks Utilize AI Tools Targeting Government and Business Sectors High·Bloomberg via GBHackersNewRead Japan is experiencing increased cyber intrusions using AI-assisted tools against public and private sector entities.
Unauthorized access was disclosed at the Electricity and Gas Transaction Surveillance Commission. Other incidents include data leaks from GMO Internet Group and exposed records from Sony Network Communications. Attackers are using AI agents and open-source tools to analyze networks and automate scanning.

Why it matters. The use of AI lowers the barrier for criminal groups to exploit outdated infrastructure and bypass security measures. Small, cash-rich firms with weak IT security are noted as attractive targets.

Do this today Patch PHP and other internet-facing software immediately; audit public websites and apps for exposed entry points.

Read the original · Bloomberg Post on X LinkedIn

Summarised from GBHackers.
```
{"coverage":0.387,"evidence":0,"freshness":0.391,"importance":0.75,"novelty":1,"quality":0.65,"total":0.487}
```
Threat Actor Impersonates AI Agents to Probe for Secrets High·Cequence via CSO OnlineNewRead An attacker cycled through fake AI identities to probe web servers for files containing credentials and API keys.
A single threat actor impersonated multiple AI agents from companies including OpenAI and Anthropic. The actor used a scanner to probe web servers for files such as .env files, cloud credentials, and private SSH keys. The scanner tested if websites accepted the bot's self-declared name in the user-agent header.

Why it matters. This activity demonstrates an attempt to bypass security controls by mimicking trusted AI sources to exfiltrate sensitive configuration data.

Do this today Implement verification for AI crawlers using published address ranges, signed requests, or direct integrations.

Read the original · Cequence Post on X LinkedIn

Summarised from CSO Online.
```
{"coverage":0.387,"evidence":0,"freshness":0.183,"importance":0.75,"novelty":1,"quality":0.8,"total":0.481}
```

Breaches & Incidents 1

Chainalysis Discloses Data Breach from Offensive Agentic Techniques High·Chainalysis via BleepingComputerNewRead Chainalysis experienced a breach exposing customer names, emails, and user IDs via offensive agentic techniques.
Chainalysis disclosed an external actor gained unauthorized access to its internal systems using offensive agentic techniques. The accessed data includes user IDs, full names, email addresses, and organizational role labels. The company stated there is no evidence of unauthorized access to investigation content, authentication credentials, or session tokens.

Why it matters. Defenders should treat credential exposure as a high risk, even if the initial breach did not touch core investigation data. Users should be vigilant against social engineering related to account access.

Do this today Enable two-factor authentication (2FA) and watch for unexpected password reset requests or authentication prompts.

Affected
Customers provisioned on the platform

Read the original · Chainalysis Post on X LinkedIn

Summarised from BleepingComputer; also covered by The Hacker News.
```
{"coverage":0.613,"evidence":0,"freshness":0.697,"importance":0.75,"novelty":1,"quality":0.95,"total":0.582}
```

CVE spotlight

CVE	Affects	CVSS	EPSS	Status
CVE-2026-111357	Ivanti Connect SecureIvanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege e…	7.0	1%	Exploited (KEV)CISA due 2 Nov
CVE-2026-118527	Ivanti Connect SecureIvanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker …	—	—	Exploited (KEV)CISA due 13 Nov
CVE-2026-97229	GitLab Community Edition and Enterprise EditionGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 th…	10.0	27%	Exploited (KEV)CISA due 1 Nov
CVE-2026-76418	Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareA vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Fi…	8.6	1%	Exploited (KEV)CISA due 1 Nov
CVE-2026-46300	Linux KernelIn the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coa…	7.8	16%	Exploited (KEV)CISA due 31 Oct (passed)
CVE-2026-41709	Broadcom VMware ESXVMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations …	2.7	1%	Exploited (KEV)CISA due 11 Nov

Quiz

Yesterday's answer

Which specific vulnerability, involving Ivanti, was added to the KEV Catalog according to the text?

CVE-2026-111357 (Ivanti)

The story explicitly lists CVE-2026-111357 (Ivanti) as one of the vulnerabilities added to the KEV Catalog.

Today's question

Which specific vulnerability was added to the KEV Catalog and is associated with Ivanti, according to the text?

On the radar tomorrow

KEV deadline tomorrowCVE-2026-111357 · Ivanti Connect Secure
KEV deadline Tue 3 NovCVE-2026-110936 · Siemens Software Center
WatchingMalicious Claude Code extension on Cursor planted SSH backdoors
WatchingWordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours

Also worth your time

Tools

MarkBlah/smsofdeathIn today's news · via BleepingComputer · Exploitation · JavaThis proof-of-concept sends a crafted SMS payload to trigger a crash in the phone's telephony process.
arpanjot-coding/AVaultNew · 172 stars in 1 day · Web & AppSec · KotlinProvides a framework for recording and encrypting audio calls on Android devices without requiring root access.
Blazenumenhir/scam-story-checkerNew · 160 stars in 1 day · OSINT · JavaScriptAnalyzes provided information against public records to verify claims and build verifiable evidence chains.
Signcluengine/onchain-money-trail-analyzerNew · 150 stars in 1 day · Recon · JavaScriptAnalyzes cryptocurrency transaction hashes across multiple blockchains to trace funds to potential exchange deposit addr…
ArcSwordKiln/osint-people-checkerNew · 140 stars in 1 day · OSINT · JavaScriptChecks individuals or entities against numerous public sources to generate a risk verdict with verifiable evidence.
DolphinStronghold9/stolen-crypto-tracerNew · 128 stars in 1 day · Forensics & malware analysis · JavaScriptTraces cryptocurrency movements across multiple blockchains to identify potential exchange deposit locations.

Community

Cloud Exposure Index 2026: 484,142 open buckets mappedr/netsec

Podcasts

181: RickyDarknet Diaries · 01:20:15
Snake Oilers: Minimal.dev, Request Rocket and TRM LabsRisky Business · 44:26
SN 1102: A Strategic Plug Pull - Lessons From a Global Patch-and-Panic Fire DrillSecurity Now · 2:54:06
Weev, Part 2Malicious Life · 28:49

And finally

OpenAI advises on submitting AI-generated bug reports

OpenAI advises open-source contributors on submitting AI-generated bug reports. Quality and coordination are emphasized over sheer volume.

CyberScoop

End of No. 251

That's today's brief.

Coming upKEV deadline tomorrow: CVE-2026-111357 · Ivanti Connect Secure

The next brief lands at 06:30 IST.

Sunday, 1 November 2026

From the editor

Actively Exploited 4

Vulnerabilities & Patches 4

Malware & Ransomware 3

Threat Actors & Campaigns 3

Breaches & Incidents 1

CVE spotlight

Quiz

On the radar tomorrow

Also worth your time

Tools

Community

Podcasts

And finally

Keyboard shortcuts

Top stories

From the editor

Actively Exploited 4

Vulnerabilities & Patches 4

Malware & Ransomware 3

Threat Actors & Campaigns 3

Breaches & Incidents 1

CVE spotlight

Quiz

On the radar tomorrow

Also worth your time

Tools

Community

Podcasts

And finally