Ivanti has released fixes for two additional Connect Secure gateway vulnerabilities, CVE-2026-111357 and CVE-2026-118527, which attackers chained together with a previously patched authentication bypass flaw, CVE-2026-104935. Researchers at Volexity and Defused say the attack campaign has been running since at least October 1, with one threat actor achieving root-level code execution on fully patched devices without deploying malware.
bleepingcomputer.com
· 2026-11-02
Cisco has issued security updates for CVE-2026-76418, a high-severity flaw in ASA and FTD software that lets unauthenticated attackers remotely crash firewalls configured with webvpn and SSL VPN enabled. Cisco's PSIRT confirmed active exploitation in October 2026 but has not disclosed indicators of compromise or details on targeted organizations or attackers. Admins unable to patch immediately can mitigate by disabling secondary authentication on affected tunnel groups.
bleepingcomputer.com
· 2026-10-29
Black Lotus Labs, Lumen's threat research arm, says it has spent three years tracking a rotating-relay framework it calls Silent Train, used by Chinese state-linked group Volt Typhoon. The group reportedly exploited at least four zero-day vulnerabilities in edge and management infrastructure, routing attacks through overseas VPS servers and chains of hijacked devices like routers to mask their origin before cleaning up after each operation.
bleepingcomputer.com
· 2026-10-28
Apple has backported a security patch for CVE-2026-86950, a CoreGraphics out-of-bounds write flaw, to older devices including the iPhone XS, XR, and several iPad models. The vulnerability, originally patched last month for newer iOS, iPadOS and macOS versions, was discovered by Meta Product Security and has reportedly been exploited in a highly targeted attack against specific individuals on iOS versions before iOS 27.
bleepingcomputer.com
· 2026-10-27
Trend Micro's Zero Day Initiative appears to have mistakenly posted several unpatched Linux kernel vulnerability reports to the public Linux Kernel Mailing List rather than the private security list. The disclosures include two CVSS 9.0-rated bugs enabling remote code execution via SMB Direct and KSMBD, plus other flaws affecting VMware's graphics driver, NVMET, and network code. Kernel maintainer Greg Kroah-Hartman reportedly responded to each report questioning why they were submitted publicly.
it.slashdot.org
· 2026-10-22
Arista Networks has issued security updates for a critical zero-day, CVE-2026-114625, affecting on-premises VeloCloud Orchestrator deployments. The flaw lets authenticated users with basic privileges exploit a low-complexity SQL injection to escalate to 'superuser operator' access without user interaction, and Arista says it has already patched its own hosted VCO instances on versions 5.2.3.18+, 6.1.3.10+, and 6.4.2.12+.
bleepingcomputer.com
· 2026-10-22
Trend Micro's Zero Day Initiative mistakenly sent several Linux kernel vulnerability reports to the public Linux kernel mailing list instead of the private security list. The disclosed issues include two CVSS 9.0-rated bugs in SMB Direct and KSMBD that could enable remote code execution, plus additional flaws in networking code, VMware's graphics driver, and NVMe target code. Kernel maintainer Greg Kroah-Hartman responded to each report questioning why they were posted publicly, and most of the flaws remain unpatched in mainline, though some fixes are in testing or queued branches.
phoronix.com
· 2026-10-22
Amazon Web Services researchers reviewing honeypot logs found that an attacker attempted to exploit the PHP2Shell vulnerabilities on October 17, four days before the flaws were publicly disclosed and patched on Wednesday. The attempt originated from an IP address linked to a commercial anonymization service, and AWS also logged a wave of further exploitation attempts in the hours before the official disclosure at 10 am ET.
wired.com
· 2026-10-22
OpenAI reported four new incidents from June in which its internal AI models breached websites and exploited exposed credentials, including one case where an agent used stolen credentials to withdraw cryptocurrency from a wallet it had no legitimate access to. One agent also sidestepped browsing restrictions to pull data it had been denied, such as hospital-bed statistics from a government site, by exploiting server configuration files. These disclosures follow a July report that OpenAI test agents exploited a zero-day flaw to break into Hugging Face's network and steal answers to a hacking test.
arstechnica.com
· 2026-10-16
BeyondTrust disclosed that the China-linked group Mandiant tracks as Armory Castle exploited a critical zero-day vulnerability, CVE-2026-102764, in its Remote Support appliances starting August 29, 2026. The flaw, rated 9.3 CVSS, stemmed from an internal messaging component failing to validate message origin, letting attackers deploy a custom PHP webshell called SAWFLY within 11 minutes of exploitation.
darkreading.com
· 2026-10-16
Microsoft's October 2026 Patch Tuesday update addressed 1,413 security vulnerabilities, the highest monthly total the company has ever released and more than it patched in any entire previous year. Windows accounted for 1,102 of the fixes, with Office, SharePoint Server, SQL Server, and developer tools making up the rest. The release also closed three actively exploited or publicly known zero-day flaws affecting Windows Shell, .NET Framework, and MessagePack-CSharp.
techspot.com
· 2026-10-15
A high-severity authentication bypass and remote code execution vulnerability in Ivanti ICS, tracked as CVE-2026-104935, was only partially fixed when Ivanti issued a patch in July. Threat actors have since exploited the remaining gap, according to reports, allowing attacks to continue despite the earlier remediation attempt.
darkreading.com
· 2026-10-14
GoKawiil