ITsecurity Daily
Daily Briefing
Actively exploited Ivanti Connect Secure zero-day headlines a record 1,411-flaw Patch Tuesday
Good morning. The most urgent item of the day is CVE-2026-104935 in Ivanti Connect Secure. CISA lists it on its Known Exploited Vulnerabilities catalog as known to be exploited. The advisory record carries a CVSS base score of 8.6 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) and lists Ivanti Connect Secure 22.8 as affected. SecurityWeek reports the flaw is part of a zero-day chain that gave attackers root access to a fully patched VPN, and that it can be exploited for unauthenticated remote code execution with elevated privileges. What to do: match your estate against Ivanti Connect Secure 22.8, follow the Ivanti advisory for the fixed release and any interim mitigation, and apply mitigations in line with CISA's BOD 26-04 and its forensics triage requirements. CISA's guidance states that where mitigations are unavailable for cloud services, organisations should discontinue use of the product.
Microsoft's October 2026 Patch Tuesday is the second headline. Krebs on Security reports Microsoft issued fixes for more than 1,400 vulnerabilities, a batch that dwarfs September's record of nearly 1,000. BleepingComputer reports the count at 1,411 flaws, including one actively exploited and two publicly disclosed zero-days. BleepingComputer also reports Microsoft released the Windows 10 KB5126657 extended security update carrying this month's fixes. Apply the October updates across your Windows estate.
Two more server-side flaws were reported Tuesday. BleepingComputer reports a critical heap buffer overflow in the Ghostscript interpreter and rendering engine that could allow remote code execution through specially crafted PDF files uploaded to servers. CISA reports that Inductive Automation Ignition is affected by an incorrect-authorization flaw in the Perspective module that could let an authenticated low-level user escalate privileges; CISA lists its sectors as critical manufacturing, energy and information technology.
Zoom out: Tuesday paired a record-breaking monthly Microsoft patch load with an actively exploited zero-day in an Ivanti VPN.
Vulnerability in focus
CVE-2026-104935 — Ivanti. CVSS 8.6 CISA lists it as known to be exploited.
Affected: ivanti-cs.
What to do: Follow the vendor advisory for the fixed release and any interim mitigation.
Elsewhere
- The Hacker News: Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave Read it
- SecurityWeek: SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities Read it
- Help Net Security: Patching and preventing issues: What are the lessons you can learn? Read it
- The Hacker News: Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug Read it
- Help Net Security: Most companies count AI agents as insiders, and CISOs worry about their own liability Read it
- Help Net Security: Google quadruples Chrome bug bounty base pay, offers up to $20,000 for sandbox escapes Read it
- The Hacker News: OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room Read it
- CISA: Inductive Automation Ignition Software Read it
- Krebs on Security: Microsoft Patches More Than 1,400 Security Flaws Read it
- SecurityWeek: Employee Arrested After Listening Device Found in OpenAI Conference Room, FBI and the Company Say Read it
- BleepingComputer: OpenAI engineer arrested for allegedly planting spy device in office Read it
- CISA: CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure Read it
Sources
- Microsoft Patches More Than 1,400 Security Flaws Krebs on Security
- Employee Arrested After Listening Device Found in OpenAI Conference Room, FBI and the Company Say SecurityWeek
- OpenAI engineer arrested for allegedly planting spy device in office BleepingComputer
- Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue The Record
- Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets The Hacker News
- Claude submitted fake murder tip to Philly police during summertime testing The Register
- Trellix Wise for Private Cloud delivers auditable AI investigations for security teams Help Net Security
- Inductive Automation Ignition Software CISA
- Ghostscript flaw lets hackers hijack servers via PDF uploads BleepingComputer
- FTC: Company netted at least $60 million charging sextortion victims for help it didn’t provide The Record
- Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days BleepingComputer
- Microsoft releases Windows 10 KB5126657 extended security update BleepingComputer
- Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN SecurityWeek
- UK Housing Ombudsman Service investigates 'security incident' BleepingComputer
Share this issue
Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky
Every briefing is on the site, with the advisory record behind it. All briefings