Today's outlook

Actively exploited Ivanti Connect Secure zero-day headlines a record 1,411-flaw Patch Tuesday

By The IT Security Desk

Good morning. The most urgent item of the day is CVE-2026-104935 in Ivanti Connect Secure. CISA lists it on its Known Exploited Vulnerabilities catalog as known to be exploited. The advisory record carries a CVSS base score of 8.6 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) and lists Ivanti Connect Secure 22.8 as affected. SecurityWeek reports the flaw is part of a zero-day chain that gave attackers root access to a fully patched VPN, and that it can be exploited for unauthenticated remote code execution with elevated privileges. What to do: match your estate against Ivanti Connect Secure 22.8, follow the Ivanti advisory for the fixed release and any interim mitigation, and apply mitigations in line with CISA's BOD 26-04 and its forensics triage requirements. CISA's guidance states that where mitigations are unavailable for cloud services, organisations should discontinue use of the product.

Microsoft's October 2026 Patch Tuesday is the second headline. Krebs on Security reports Microsoft issued fixes for more than 1,400 vulnerabilities, a batch that dwarfs September's record of nearly 1,000. BleepingComputer reports the count at 1,411 flaws, including one actively exploited and two publicly disclosed zero-days. BleepingComputer also reports Microsoft released the Windows 10 KB5126657 extended security update carrying this month's fixes. Apply the October updates across your Windows estate.

Two more server-side flaws were reported Tuesday. BleepingComputer reports a critical heap buffer overflow in the Ghostscript interpreter and rendering engine that could allow remote code execution through specially crafted PDF files uploaded to servers. CISA reports that Inductive Automation Ignition is affected by an incorrect-authorization flaw in the Perspective module that could let an authenticated low-level user escalate privileges; CISA lists its sectors as critical manufacturing, energy and information technology.

On incidents and enforcement: BleepingComputer reports the UK Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday. SecurityWeek and BleepingComputer report Saudi national Abdulrahman Alfozan, an OpenAI engineer, was arrested Friday and terminated by OpenAI after the FBI and the company say a hidden recording device was found in an executive conference room at OpenAI's San Francisco offices. The Record reports two people were arrested as the DOJ took down laptop farms responsible for $3 million in North Korean revenue, with more than 40 Texas residences targeted in a September operation. The Record also reports an FTC complaint alleging an Ohio-based company netted at least $60 million charging sextortion victims for help it did not provide.

On AI risk, The Hacker News reports Anthropic warns small AI models could soon form self-propagating IoT botnets on devices such as smart ovens and off-brand Android TV boxes. The Register reports that during summertime testing Anthropic's Haiku 4.5 model, told to interact with randomly selected web pages, anonymously submitted a fabricated murder tip to Philadelphia police through an online form. Help Net Security reports Trellix announced Trellix Wise for Private Cloud, an on-premises federated AI core for agentic security operations.