Today's outlook

Three actively-exploited flaws lead Thursday's fixes — Ivanti, Microsoft and Palo Alto

By The IT Security Desk

Good morning. CISA's Known Exploited Vulnerabilities catalog lists CVE-2026-104935 in Ivanti Connect Secure as actively exploited. Ivanti's advisory names version 22.8 as affected. The flaw carries CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, base score 8.6 — reachable across the network with no privileges and no user interaction. Ivanti's advisory directs administrators to the fixed release and any interim mitigation (https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935).

CISA's catalog also lists CVE-2026-96951 in Microsoft Windows Server as actively exploited. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 8.8. Microsoft's advisory says to apply the vendor patch and names build 10.0.14393.9612 as the fix (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951).

The third exploited flaw CISA lists is CVE-2026-0322 in Palo Alto Networks PAN-OS, with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base score 7.2. Palo Alto's advisory lists releases up to the fix in 10.2.0 as affected and points to the fixed release and interim mitigation (https://security.paloaltonetworks.com/CVE-2026-0322).

Google published fixes for three Chrome flaws — CVE-2026-110159, CVE-2026-110161 and CVE-2026-110165 — each carrying CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base score 9.6, with a scope change. Google's advisory names 155.0.8059.79 as the fixed version (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html). These are not on CISA's KEV catalog.

On live campaigns, BleepingComputer reported threat actors are exploiting a critical command-execution flaw in the Collabora Online built-in CODE Server app for Nextcloud to backdoor servers; a proxyjacking campaign hijacking D-Link and Ubiquiti devices across 34 countries to resell victims' bandwidth; and malicious packages uploaded to the Arch User Repository impersonating the yay and paru helper tools, delivering malware with root privileges.

The Record reported a contractor cyberattack that halted all production of federal bankruptcy notices, and, citing Citizen Lab, zero-click spyware infecting devices worldwide through targeted ads. The Register reported researchers warned in August that attackers could defrost the food before French supermarkets were hit, and that indirect prompt injection is turning up in webpage headers. The Hacker News reported PwnEscape, a Linux kernel flaw letting guest VMs read host memory, demonstrated against Vercel's sandboxes and confirmed by Vercel. Help Net Security, citing Group-IB, detailed KGB RAT, a Windows trojan with webcam, microphone and password-theft features. CISA added one Atlassian "Files or Directories Accessible to External Parties" vulnerability to its KEV catalog (https://www.cisa.gov/news-events/alerts/2026/10/15/cisa-adds-one-known-exploited-vulnerability-catalog).

What to do: treat the KEV-listed Ivanti, Microsoft and Palo Alto flaws as the priority and apply the vendor fixes named above; update Chrome to 155.0.8059.79; review exposure of Nextcloud/Collabora installs, D-Link and Ubiquiti devices, and any use of yay or paru from the AUR against the outlets' indicators.