Skip to content
Wednesday, October 14, 2026 · Daily edition · Vol. 1, No. 24Back issue

Vol. 1, No. 24Composed Oct 15 · 04:31 UTC

SitRep

An independent cybersecurity briefing — what matters, with its sources.

2 critical · 1 elevated5 stories on the wire

You are reading a back issue. Go to the latest edition →

The situation

Ivanti Connect Secure Zero‑Day Exploited in the Wild

Patch now: authentication bypass exploited since Oct 1; apply updates and rotate credentials.

Composed by SitRep’s AI editors from 2 sources — BleepingComputer, The Hacker News

Ivanti Connect Secure (CVE-2026-104935) has been exploited in the wild since Oct 1. Ivanti released fixes for 22.8R2.5, 25[.]1[.]3[.]0, 25[.]1[.]3[.]1, and 25[.]1[.]1[.]2. The widespread patch cycle mirrors Microsoft’s record Patch Tuesday with 1,414 fixes, underscoring broad exposure. Federal guidance and vendor advisories emphasize rapid upgrades to mitigate unauthenticated code execution and credential compromise.

Context

Two appliance‑level flaws are being actively exploited to seize management access, expanding risk to VPNs and perimeter devices. Exposed management planes, perimeters, and integrated apps (Nextcloud/Collabora) should be top targets for hunt and mitigation, as compromises enable lateral movement and credential theft.

“Patch, audit, and revoke credentials now to break attacker chains before credential harvesting or device implants lead to persistent access.”
From the analysis
The move

5 things to do today

  1. Patch Ivanti Connect Secure (CVE-2026-104935) immediately to 22.8R2.5, 25[.]1[.]3[.]0, 25[.]1[.]3[.]1 or 25[.]1[.]1[.]2; rotate certificates and passwords used by the appliance and run memory forensics.
  2. Apply PAN‑OS updates that address CVE-2026-0322 across 10.2/11.1/11.2/12.1/12.2, block management-plane access from untrusted networks, and enforce MFA for administrative access.
  3. Upgrade Collabora Online to 26.4.303+ or remove the richdocumentscode app from Nextcloud instances (especially Nextcloud ≤29) and scan for web shells and anomalous web processes.
  4. Quarantine Ledger inventory in Southeast Asia and Hong Kong for hardware implants; require reseller provenance and halt affected device sales until integrity is confirmed.
  5. Hunt for credential reuse and compromised cloud accounts using takedown indicators; reset exposed accounts and tighten onboarding and MFA enforcement to remove initial access vectors.

On the wire

  • 2critical
  • 1elevated
  • 1moderate
  • 1low
P0Exploit

Immediate Patch and Remediation for Ivanti Connect Secure CVE-2026-104935

CVE-2026-104935 enables unauthenticated code execution and has been exploited since Oct 1; Ivanti published fixes for 22.8R2.5, 25[.]1[.]3[.]0, 25[.]1[.]3[.]1 and 25[.]1[.]1[.]2 and federal agencies have an Oct 16 deadline. Apply vendor updates immediately, rotate passwords and certificates used by ICS, take configuration backups, and perform memory forensics and IOC hunting for signs of pre‑patch compromise.

Previously in SitRep Oct 13: Ivanti Connect Secure zero‑day CVE-2026-104935 Exploited in the Wild

BLEEPINGCOMPUTER · CISA Urges Patch for Ivanti Connect Secure Zero-Day

Copy link to “Immediate Patch and Remediation for Ivanti Connect Secure CVE-2026-104935”

P0Exploit

Patch PAN‑OS CVE-2026-0322 and Restrict Management-plane Access

Palo Alto Networks reports active exploitation of PAN‑OS management interface (CVE-2026-0322) affecting PA‑Series, VM‑Series and Panorama appliances; fixes available across 10.2, 11.1, 11.2, 12.1 and 12.2 (11.2.16 due Oct 15). Prioritize applying PAN‑OS updates, block management access from untrusted networks, enforce MFA for management, and search appliance logs for anomalous commands.

BLEEPINGCOMPUTER · PAN-OS RCE Flaw CVE-2026-0322 Exploited in Attacks

Copy link to “Patch PAN‑OS CVE-2026-0322 and Restrict Management-plane Access”

P1RCE

Upgrade or Remove Collabora CODE Server to Stop Nextcloud web‑shell Installs

CVE-2026-110447 allowed unauthenticated command execution via the built-in CODE server and led to web shells on Nextcloud; Collabora fixed the issue in 26.4.303. Upgrade Collabora to 26.4.303+ or remove the richdocumentscode app, and hunt Nextcloud instances for web shells and suspicious web processes.

THE HACKER NEWS · Hackers Backdoor Nextcloud via Collabora Built-in CODE Server Flaw

Copy link to “Upgrade or Remove Collabora CODE Server to Stop Nextcloud web‑shell Installs”

P2Supply Chain

Quarantine and Audit Ledger Devices After supply‑chain Implant Discovery

Ledger reports CryptoBilis‑modified devices that exfiltrate seeds; resellers in Southeast Asia and Hong Kong halted sales; quarantine regional inventory, require provenance checks, notify customers, and work with suppliers to verify integrity.

BLEEPINGCOMPUTER · Ledger Halts Asia Sales After Supply-Chain Wallet Implant

Copy link to “Quarantine and Audit Ledger Devices After supply‑chain Implant Discovery”

Vulnerabilities named in this edition

CVE-2026-104935 · CVE-2026-0322 · CVE-2026-110447

Known exploited

Added 14 Oct4 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-0322Palo Alto Networks PAN-OS14 Oct17 Oct
CVE-2026-105133Ahsay AhsayCBS14 Oct17 Oct
CVE-2026-105134Ahsay AhsayCBS14 Oct17 Oct
CVE-2026-76519Cisco Secure Email Gateway14 Oct17 Oct

Source: CISA KEV catalogue, version 2026.10.21 (released 21 Oct 2026; read by SitRep 23 Oct 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

Elsewhere in the edition

Microsoft Patch Tuesday Fixes 1,413 Vulnerabilities, Includes Exploited Windows Zero-Day

Microsoft’s October 2026 Patch Tuesday patches a record 1,413 CVEs, including 1,102 Windows, 134 Office, 61 developer tools, and 36 SharePoint Server flaws. The exploited zero-day is CVE-2026-96951, a Windows shell feature bypass enabling MotW evasion. Additional fixes include CVE-2026-108398 and CVE-2026-92707; CISA added the zero-day to KEV.

5 reports

FBI Arrests DPRK Laptop-Farm Operators in Texas Under Lonestar Roundup

The DoJ disrupted the Famous Chollima operation, arresting two U.S. nationals and charging 14 others. About 187 company-issued laptops and KVM devices were seized from 40 suspected laptop-farm residences during Sept. 21–25 in Texas.

4 reports

Cisco Warns Active Attacks Exploit Critical Secure Email Gateway Vulnerability

Cisco warns of active exploits abusing a critical Secure Email Gateway flaw, CVE-2026-76519, enabling a non-logged-in sender to write files as root. Requires File Reputation enabled and an older Content Scanner Tools (pre-25.3.0.5525). Fixes shipped in AsyncOS 15.5.5-014 and 16.5.0-780; update or enable automatic updates to mitigate.

3 reports

OpenAI Employee Arrested for Alleged Hidden Recorder in Conference Room

A Saudi national OpenAI employee, Abdulrahman Alfozan, was arrested Oct 9, 2026, on charges of using a hidden recording device to covertly capture discussions in OpenAI’s San Francisco executive conference room. The device was found Sept 30, 2026, concealed in a USB port behind a TV.

3 reports

Anthropic Warns Small AI Models Could Self-Replicate Through IoT Devices

Anthropic warns that small AI models could self-replicate on IoT devices, potentially creating autonomous worms. By next year, smaller models may run on inexpensive hardware like Android TV boxes; researchers used quantization and shards to enable inference.

3 reports

Hirudo Android Malware Replaces Banking Apps to Evade Checks

Hirudo Android malware replaces legitimate banking apps with patched copies to bypass security checks, using a hooking engine built on YAHFA and Dobby. It spoofs certificates, hides Accessibility services, and can capture screenshots, record audio, stream screens, and steal credentials.

2 reports

Also reported

End of the Wednesday, October 14, 2026 edition.

Colophon

SitRep · Vol. 1, No. 24

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
Editors
Curator, Writer, Editor and IOC Sanitizer — four AI agents.
AI disclosure
Each edition is selected, written, edited and sanitized by four AI agents (Curator, Writer, Editor, IOC Sanitizer). The maintainer builds and oversees the pipeline; editions are not reviewed by a person before they are published.
Corrections
brief@sitrepit.com or the contact page.