Seit mindestens Oktober nutzen Angreifer die Verkettung von Zero-Day Schwachstellen in Ivanti Connect Secure für verschiedene Operationen.
Der Hersteller hat Patches veröffentlicht, die eine Ausnutzung der Schwachstelle CVE-2026-104935 und somit auch Angriffe über die beobachtete Exploit-Kette verhindern. Betreiber sollten schnellstmöglich die von Ivanti empfohlenen Maßnahmen prüfen: https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-297569-1032

CISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 13, 2026.

https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure

#CISA #KEV #Ivanti #zeroday

⚠️Alerte CERT-FR⚠️

La vulnérabilité CVE-2026-CVE-2026-104935 permet à un attaquant non authentifié l'exécution de code arbitraire à distance dans Ivanti Connect Secure. Elle est activement exploitée.
https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-013/

CISA and Ivanti released urgent warnings this week about CVE-2026-104935 — a bug found in Ivanti’s Connect Secure product

https://therecord.media/new-ivanti-microsoft-bugs-exploitation

Discover how a critical Ivanti Connect Secure vulnerability (CVE-2026-104935) is chained in zero-day attacks to gain root access and steal network secrets.

#Ivanti #ConnectSecure #Cybersecurity #ZeroDay #InfoSec

https://securityexpress.info/ivanti-connect-secure-vulnerability-cve-2026-104935/?utm_source=mastodon&utm_medium=jetpack_social

Ivanti Connect Secure: catena di 3 zero-day sfruttata da UTA0576 (Volexity) dal 3/10, root unauthenticated su appliance già patchate. CVE-2026-104935 (auth bypass + RCE) patchata il 13/10; la privilege escalation no, fix atteso "nelle prossime settimane".

Nessuna web shell: la catena è rieseguita a ogni comando, l'ICT non la vede. Hunt: richieste a welcome.cgi con X-DSCGI-PATH incoerente, /data/.icscap/, 108.165.147[.]64.

#cybersecurity #infosec https://volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

(CISA TS-MAN) The Cyber Mind TSUITE Brief: CVE-2026-104935 – Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

CVE-2026-104935 calls for version-specific review of Ivanti Connect Secure deployments. This technical brief covers vulnerability impact, remediation decisions, and investigation priorities while clearly identifying the limits of unvalidated detection content....

https://thecybermind.co/kjcm

📰 CISA Warns of Actively Exploited Zero-Day in Ivanti Connect Secure

CISA issues urgent warning for actively exploited zero-day CVE-2026-104935 in Ivanti Connect Secure. The auth bypass flaw allows RCE. Patch immediately. #Ivanti #ZeroDay #CVE #InfoSec

🔗 https://cyber.netsecops.io/articles/cisa-warns-of-actively-exploited-ivanti-connect-secure-zero-day/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

CISA has issued an urgent directive for organizations to update Ivanti Connect Secure appliances addressing CVE-2026-104935, an authentication bypass with a CVSS score of 8.6 affecting versions 25.1.1.1, 25.1.2.2, 22.8R2.4 and prior.

The flaw enables remote unauthenticated attackers to execute arbitrary commands and is actively exploited in the wild for credential theft and data exfiltration, prompting mandatory federal patching dea…

https://en.hacks.gr/amesi-enimerosi-zita-i-cisa-gia-systimata-ivanti-logo-epitheseon/

#Ivanti #CISA #Vulnerability #Patch

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-104935 – Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Executive briefing on CVE-2026-104935 impacting Ivanti Connect Secure, featuring active exploitation telemetry, backdoor removal strategies, and endpoint hardening protocols....

https://thecybermind.co/veou

Windows Fixes an Exploited Bypass, Plus 3 Stories https://raymondtec.com/2026/10/windows-security-update-fixes-exploited-bypass/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief

October’s Windows security update fixes an exploited download-warning bypass. Plus a Supreme Court privacy case, an Ivanti VPN zero-day, and a Docker Hub token flaw.

#TechNews #CVE2026104935 #CVE202696951 #DockerHub #IvantiConnectSecure #microsoft #privacy

A UAF turned RCE

In the #curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as CVE-2026-92392 with the title HTTP/2 upload Use-After-Free.

https://daniel.haxx.se/blog/2026/10/14/a-uaf-turned-rce/

It is 0 Days since it was #useafterfree #curl #RCE

Package : curl
CVE ID : CVE-2026-92392

#adminLive

A high-severity memory corruption vulnerability in curl and libcurl HTTP/2 uploads allows malicious servers to corrupt client memory, which a researcher successfully turned into code execution.

Affected: curl versions 8.12.0 through 8.22.0.

Status: Fixed in curl 8.23.0 and branch updates released on October 14, 2026.

Mitigation: Update immediately or force HTTP/1.1 if patching is delayed.

https://en.hacks.gr/sovaro-provlima-asfaleias-sto-curl-epitrepei-se-diakomistes-na-apoktisoyn-elegcho-syskeyon/

#curl #libcurl #CVE202692392 #patch

curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution

A use-after-free flaw in how curl handles HTTP/2 uploads (CVE-2026-92392) lets a malicious server corrupt the memory of a client uploading to it, and the reporting researcher demonstrated code execution on the client machine, The Hacker News reports. The flaw affects curl and libcurl 8.12.0 through 8.22.0 and is fixed in curl 8.23.0, released early on October 14. https://thehackernews.com/2026/10/curl-patches-http2-upload-flaw-after.html

🚨 NEW on CISA KEV — exploited in the wild

🛡 Microsoft Windows
Microsoft Windows Command Injection Vulnerability
CVE: CVE-2026-96951 · patch by 2026-10-16

Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.

🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-96951
#cybersecurity #KEV #CVE #infosec

Microsofts Patch tirsdag i denne måned fastsatte 1.411 sårbarheder, herunder en aktivt udnyttet #0day

.. er CVE-2026-96951, en Windows Shell sikkerheds-funktion bypass bruges til at unddrage Mark of the Web (MOTW)
https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct

Flere nyheder: https://news.risky.biz/risky-bulletin-spyware-chip-found-in-ledger-crypto-wallets/

Patch Tuesday Oktober 2026: Microsoft schließt 1.417 Sicherheitslücken

Eine Lücke war bereits vor dem Patch Tuesday öffentlich bekannt, eine weitere, CVE-2026-96951 in der Windows-Shell, wird schon ausgenutzt. Administratoren sollten diesen Fehler zuerst beheben, denn die CISA-Frist endet am 16. Oktober.

https://www.all-about-security.de/patch-tuesday-oktober-2026-microsoft-schliesst-1-417-sicherheitsluecken/

#patchTuesday #microsoft

Microsoft Patches More Than 1,400 Security Flaws

Microsoft has issued updates fixing more than 1,400 security vulnerabilities in Windows and other software, dwarfing September’s record of nearly 1,000 fixes, Krebs on Security reports. The batch includes one zero-day, CVE-2026-96951, a Windows Shell security feature bypass, and at least 78 flaws rated critical. https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws/

⚠️ CRITICAL: Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day

Microsoft released patches for 1,413 vulnerabilities in October 2026, including CVE-2026-96951, a critical Windows zero-day that bypasses Mark of the Web security controls. This flaw is actively exploited in the wild and tracked by CISA. Windows systems are the primary target across 1,102 of the pa…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

📰 Microsoft's Record October Patch Tuesday Fixes 1,413 Flaws, 1 Exploited Zero-Day

Microsoft's October 2026 Patch Tuesday is a record-breaker, fixing 1,413 vulnerabilities. Includes patch for actively exploited zero-day CVE-2026-96951 (Windows Shell MotW bypass). CISA KEV added. #PatchTuesday #CyberSecurity #ZeroDay

🔗 https://cyber.netsecops.io/articles/microsoft-october-2026-patch-tuesday-fixes-1413-flaws-one-exploited-zero-day/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Windows Fixes an Exploited Bypass, Plus 3 Stories https://raymondtec.com/2026/10/windows-security-update-fixes-exploited-bypass/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief

October’s Windows security update fixes an exploited download-warning bypass. Plus a Supreme Court privacy case, an Ivanti VPN zero-day, and a Docker Hub token flaw.

#TechNews #CVE2026104935 #CVE202696951 #DockerHub #IvantiConnectSecure #microsoft #privacy

The October 2026 Patch Tuesday fixes 1,414 flaws and three zero-day vulnerabilities, including an exploited Windows Shell bypass. Patch now.

#PatchTuesday #Microsoft #CVE202696951 #CVE2026108398 #ZeroDay #Windows #PatchNow #CyberSecurity

https://securityonline.info/october-2026-patch-tuesday/?utm_source=mastodon&utm_medium=jetpack_social

⚠️ CRITICAL: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days

Microsoft patched 1,411 vulnerabilities in October 2026, including three zero-days: CVE-2026-96951 (Windows Shell, actively exploited) and CVE-2026-108398 (.NET Framework, publicly disclosed). CVE-2026-108398 allows attackers to bypass Windows Defender Application Control and execute unauthorized a…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

🚨 Rapid Response: Critical GitLab CI/CD Remote Code Execution (CVE-2026-97229)
A critical vulnerability (CVSS 10.0) in GitLab Community Edition and Enterprise Edition could allow an unauthenticated attacker to execute arbitrary code on the GitLab server.

Censys currently detects 25,766 hosts and 79,224 web properties with a version of GitLab affected by this vulnerability. This is 31% and 39% of all GitLab hosts and web properties, respectively. These figures reflect detected software versions, not confirmed exploitable instances.

GitLab has released patches for affected versions. Organizations running self-managed GitLab should prioritize updating.

Full Censys ARC advisory, including affected versions, exposure data, and remediation guidance: https://censys.com/advisory/cve-2026-97229/

#CensysARC #GitLab #Cybersecurity #VulnerabilityManagement #InfoSec

Technical details and PoC exploit code for CVE-2026-97229, a CVSS 10.0 GitLab RCE vulnerability exposing 25,766 hosts, are now public. Patch to 19.4.2 now.

#CVE202697229 #GitLab #RCE #DevSecOps #Cybersecurity #InfoSec #Vulnerability

https://securityonline.info/gitlab-rce-cve-2026-97229-poc-disclosed/?utm_source=mastodon&utm_medium=jetpack_social

🚨 PoC published for a critical GitLab CI/CD remote code execution vulnerability; CVE-2026-97229

PoC: https://github.com/jburgess-r7/CVE-2026-97229-PoC

The flaw is caused by an integer overflow in GitLab's regular expression compiler. A crafted CI/CD configuration combined with a specially formed repository path can corrupt Onigmo regex bytecode and ultimately execute operating system commands as the GitLab git user.

CVSS: 10.0 Critical
Affected: GitLab 19.2 < 19.2.8, 19.3 < 19.3.5, and 19.4 < 19.4.2
Fixed: GitLab 19.2.8, 19.3.5, and 19.4.2

The PoC was validated against GitLab CE 19.4.1 on Linux amd64 and demonstrates command execution through the public CI lint endpoint after the required malicious project setup.

A GitLab critical vulnerability, CVE-2026-97229, allows unauthenticated code execution. Update to 19.2.8, 19.3.5, or 19.4.2 now.

#GitLab #CVE202697229 #RCE #CICD #DevSecOps #Vulnerability #PatchNow #GitLabDuo

https://meterpreter.org/gitlab-critical-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

Vorfall-Lagebild: GitLab: kritische Lücke CVE-2026-97229

Erstmeldung zu „GitLab: kritische Lücke CVE-2026-97229“: was bekannt ist, was offen ist und was wahrscheinlich passiert ist.

#OTSecurity #ICS #KRITIS #NIS2 #Cybersicherheit
https://ot-cyber.de/blog/vorfall-lagebild-gitlab-kritische-luecke-cve-2026-97229.html

GitLab-Sicherheitslücke CVE-2026-97229: PoC-Exploit veröffentlicht

Zur GitLab-Schwachstelle CVE-2026-97229 sind technische Details und ein Proof-of-Concept-Exploit öffentlich. Die Lücke erreicht den CVSS-Höchstwert von 10.0 und ermöglicht Remote Code Execution.

https://www.all-about-security.de/gitlab-sicherheitsluecke-cve-2026-97229-poc-exploit-veroeffentlicht/

#gitlab #cve #itsecurity

CVE-2026-0322 is an EITW post-auth RCE in PAN-OS management interface.

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.

This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).

Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

Very limited exploitation has been observed targeting the Palo Alto Networks management interface.

https://security.paloaltonetworks.com/CVE-2026-0322

If your Palo Alto management interface is internet-exposed, you might notice even more traffic on it today. But if that was your security posture, maybe you're fine with that.

Anyway this is exploited in the wild. Authenticated, so creds required.

https://ifin.network/t/cve-2026-0322-authenticated-rce-in-pan-os/903

#ThreatIntel #ThreatIntelligence #IFIN

Palo Alto Networks zero-day: CVE-2026-0322 (CVSS4: 8.6 high)PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

Very limited exploitation has been observed targeting the Palo Alto Networks management interface.

CISA added this to the KEV Catalog today: https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog

#paloaltonetworks #zeroday #KEV #CISA #eitw

Attackers are actively exploiting CVE-2026-0322, a high-severity Palo Alto PAN-OS RCE vulnerability in the management interface. Apply patches right now.

#CVE20260322 #PaloAltoNetworks #PANOS #RCE #FirewallSecurity #Cybersecurity #InfoSec

https://securityonline.info/palo-alto-pan-os-rce-cve-2026-0322-exploited/?utm_source=mastodon&utm_medium=jetpack_social

Technical details and PoC exploit code for CVE-2026-74580 (Vghost), an 8.8-severity Linux vhost vulnerability allowing root LPE and VM escape, are out.

#CVE202674580 #Vghost #LinuxKernel #PrivilegeEscalation #VMEscape #Cybersecurity #InfoSec

https://securityonline.info/vghost-cve-2026-74580-linux-vhost-poc-disclosed/?utm_source=mastodon&utm_medium=jetpack_social

A multi-year vulnerability tracked as CVE-2026-74580, dubbed Vghost, affects Linux kernels from version 4.11 up to 7.2-rc4.

Discovered by Tencent Zhuque Lab, the flaw in the vhost subsystem allows a local user to read and write arbitrary kernel memory and achieve root escalation.

Researchers have published full technical details and working demos, though no active exploitation has been reported.

https://en.hacks.gr/sovaro-keno-asfaleias-ston-pyrina-toy-linux-epitrepei-pliri-elegcho-systimaton/

#Linux #Kernel #Vulnerability #CVE202674580

Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572) https://embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution/

PoC and technical details for CVE-2026-103572, an 8.8-severity Visual Studio Copilot RCE and SSMS flaw, are now public. Patch your IDE immediately.

#CVE2026103572 #VisualStudio #Copilot #RCE #MicrosoftSecurity #SSMS #Cybersecurity

https://securityonline.info/cve-2026-103572-visual-studio-copilot-rce-disclosed/?utm_source=mastodon&utm_medium=jetpack_social

Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)

Microsoft has shipped a patch for a remote code execution vulnerability (CVE-2026-103572) in Visual Studio Copilot and SQL Server Management Studio. The flaw let Copilot bypass a path validation check, write to its own settings and configuration files, and achieve arbitrary command execution. https://embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution/

Attackers are actively exploiting CVE-2026-110447 (CVSS 9.2), a critical Nextcloud Collabora Online RCE flaw in richdocumentscode, to deploy PHP webshells.

#CVE2026110447 #Nextcloud #CollaboraOnline #RCE #Webshell #Cybersecurity #InfoSec #354

https://securityonline.info/nextcloud-collabora-online-cve-2026-110447-exploited/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-110447 (CRITICAL, CVSS 9.2) allows RCE via OS command injection in Collabora Online Built-in CODE Server <26.4.303 (richdocumentscode, Nextcloud). Exploited in the wild since Sept 2026. Patch required. https://radar.offseq.com/threat/cve-2026-110447-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-f68ba52513af6028 #OffSeq #Infosec #Nextcloud #CVE2026110447

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Attackers have exploited a flaw in the Collabora Online built-in CODE app for Nextcloud to plant web shells on servers, The Hacker News reports. The unauthenticated command-execution flaw (CVE-2026-110447) can be triggered when the app’s local document server is stopped, such as during a restart or upgrade; Collabora fixed it in September and warns that disabling the app is not enough — it must be updated or removed. https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html

Researchers at Doyensec breached a Windows VBS enclave associated with Microsoft Defender SmartScreen’s Enhanced Phishing Protection (CVE-2026-83498).

The issue required local access to the computer.

Microsoft rated it Critical (CVSS 7.8) and fixed it in the September 8, 2026 update, KB5124008, for Windows 11 24H2 and 25H2.

The update blocks the vulnerable SFAPE.dll from loading.

There is no evidence the flaw was used in r…

https://en.hacks.gr/keno-asfaleias-sta-windows-i-microsoft-kykloforise-diorthotiki-enimerosi/

#Windows11 #VBS #SmartScreen #CVE202683498

Cisco zero-day: CVE-2026-76519 (CVSS3.1: 9.8 critical) Cisco Secure Email Gateway Arbitrary File Write Vulnerability

In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp

CISA added this to the KEV Catalog today: https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog

#Cisco #zeroday #CVE #KEV #CISA

Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

Attackers are exploiting a critical flaw in Cisco Secure Email Gateway (CVE-2026-76519, CVSS 9.8) that lets an unauthenticated sender write files to the appliance’s operating system via a crafted email attachment and potentially run commands as root, The Hacker News reports. Only gateways with the File Reputation service enabled and an older Content Scanner Tools package are vulnerable; fixes shipped in September and in a Content Scanner Tools update. https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html