Skip to content
Saturday, October 31, 2026Oct 31, 2026
Previous issue

Vol. 1, No. 39Composed Oct 31 · 16:44 UTC

SitRep

Cybersecurity, in perspective.

1 critical · 2 elevated4 stories on the wire

Keep the perimeter patched; persistence follows unpatched edges.
— Senecowitz Draper
ⓘAn invented Stoic/VC pen name, paired with this edition’s AI-written reflection.

You are reading a previous issue. Go to the latest edition →

The situation

Ivanti Connect Secure Chains Lead to Root

CISA added two Ivanti CVEs to KEV after exploitation; patch Deadlines urge immediate remediation.

4 sources

The Hacker News, Palo Alto Networks Security Advisories, Cisco Talos Vulnerability Reports, Microsoft Secure

The Hacker News reports CISA added CVE-2026-111357 and CVE-2026-118527 to the Known Exploited Vulnerabilities catalog after an attacker chain reached unauthenticated root on Ivanti Connect Secure that includes CVE-2026-104935. Vendor fixes are published for releases 25.1.1.3 and 22.8R2.6 and FCEB agencies have compliance deadlines of Nov 2 and Nov 13, 2026.

Context

CISA's KEV additions signal active exploitation and a documented attack chain combining authentication bypass, remote code execution, and privilege escalation to achieve root on Ivanti Connect Secure appliances, per The Hacker News. Appliances exposing remote-access interfaces and organizations that allow appliance management from unfiltered networks are the most likely blast radius; vendor patches and the federal deadlines define immediate remediation windows.

Contrarian view

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Teams Will Treat Ivanti Flaws as Edge Appliance Only

Most security teams will treat the Ivanti KEV additions as 'vendor/edge appliance only'. That is the wrong read because the documented chain yields unauthenticated root access, enabling lateral movement and persistence that directly elevates risk across enterprise networks where those appliances provide remote access.

The Hacker News

The move

5 things to do today

  1. Patch Ivanti Connect Secure to versions 25.1.1.3 or 22.8R2.6 per vendor advisories; if immediate patching is impossible, apply network-level compensations and isolate management interfaces until patched (CVE-2026-111357, CVE-2026-118527, CVE-2026-104935).
  2. Apply Palo Alto mitigations: disable Brotli inspection or upgrade PAN-OS to fixed builds; verify cloud SaaS rollouts have been applied.
  3. Hunt for local exploitation of cldflt.sys: instrument endpoint EDR for calls to the Cloud Filter API and unusual CldiStreamCompleteRequest sequences, and prioritize remediation or blocking for hosts running cldflt.sys v10.0.26100.8457 (CVE-2026-58613).
  4. Remove impacted Cursor Marketplace releases (2.1.313, 2.1.312), rotate SSH keys and credentials used on developer hosts, and audit startup persistence and open SSH tunnels for signs of the loader described by Microsoft.
  5. Monitor appliance and VPN access logs, and escalate anomalous administrative sessions and configuration changes for immediate investigation; treat any successful appliance compromise as a potential initial access vector for lateral movement.

On the wire

  • 1critical
  • 2elevated
  • 1moderate
  • 0low
P0Exploit

Ivanti Connect Secure Enables Unauthenticated Root

CVE-2026-111357 · CVE-2026-118527 · CVE-2026-104935 · fixes in 25.1.1.3 and 22.8R2.6

CISA added two Ivanti Connect Secure CVEs to KEV after reporting that attackers chained those flaws with CVE-2026-104935 to obtain unauthenticated root on appliances; the chain combines authentication bypass, remote code execution and privilege escalation. FCEB deadlines require remediation by Nov 2 and Nov 13, 2026.

Previously in SitRep Oct 14: Immediate Patch and Remediation for Ivanti Connect Secure CVE-2026-104935

Timeline

  1. Oct 13Ivanti Connect Secure zero‑day CVE-2026-104935 Exploited in the Wild
  2. Oct 14Immediate Patch and Remediation for Ivanti Connect Secure CVE-2026-104935
  3. This edition

Single sourceThe Hacker News

Added to CISA KEV: CVE-2026-104935 on 13 Oct 2026; CVE-2026-111357 on 30 Oct 2026; CVE-2026-118527 on 30 Oct 2026 · CVE-2026-111357: CVSS 7.0, EPSS <0.01 (FIRST); CVE-2026-104935: EPSS 0.87 (FIRST)

THE HACKER NEWS · Attackers chain Three Ivanti Connect Secure Flaws to Root Access

Copy link to “Ivanti Connect Secure Enables Unauthenticated Root”

P1Exploit

Brotli Decoder Overflow Affects Palo Alto PAN-OS

PAN-OS 10.2–12.2 mitigations and Google Brotli 1.0.3–1.2.0

Palo Alto Networks discloses a Brotli decoder buffer overflow that can cause memory corruption, denial of service or arbitrary code execution in affected PAN-OS builds; cloud SaaS backends are being rolled, and mitigations listed include disabling Brotli inspection or upgrading to fixed PAN-OS builds. Palo Alto reports no known exploitation at this time.

Updated Since Oct 29: Brotli Decoder Buffer Overflow Risks PAN-OS Dataplane · CVE-2026-111497 · New: blogs.cisco.com, aws.amazon.com, databreaches.net

Timeline

  1. Oct 27Google Brotli Decoder Flaw Enables Remote Code Execution
  2. Oct 29Brotli Decoder Buffer Overflow Risks PAN-OS Dataplane
  3. This edition

Added to CISA KEV on 27 Oct 2026 (CVE-2026-111497) · CVE-2026-111497: CVSS 9.2, EPSS 0.83 (FIRST), patch listed (GitHub)

PALO ALTO NETWORKS SECURITY ADVISORIES · CVE-2026-111497 Impact on Palo Alto Networks Products

Copy link to “Brotli Decoder Overflow Affects Palo Alto PAN-OS”

P1Exploit

Windows Cloud Files Driver Permits Local Privilege Escalation

cldflt.sys v10.0.26100.8457 · CVSS 8.8

Cisco Talos describes a use-after-free in the Windows Cloud Files mini filter (cldflt.sys) triggered by a crafted Cloud Filter API sequence that can enable local privilege escalation; exploitability requires a dedicated application to invoke the API. Talos provides vulnerable product references and technical details for detection.

Single sourceCisco Talos Vulnerability Reports

CVE-2026-58613: EPSS <0.01 (FIRST); CVE-2023-29361: EPSS 0.04 (FIRST)

CISCO TALOS VULNERABILITY REPORTS · Talos Warns of Windows Cloud Files Mini Filter Driver UAF Privilege Escalation

Copy link to “Windows Cloud Files Driver Permits Local Privilege Escalation”

P2Supply Chain

Malicious Cursor Extension Installs Persistent SSH Backdoor

Cursor Marketplace releases 2.1.313 and 2.1.312 · loader added SSH keys and reverse tunnel

Microsoft reports a malicious Claude Code-branded extension in the Cursor Marketplace that injected a loader which added SSH keys, enabled SSH, created a reverse tunnel and established startup persistence on compromised developer hosts; evidence indicates the compromise was limited to Cursor and not the Microsoft Marketplace. Microsoft publishes remediation guidance for affected Cursor releases.

Single sourceMicrosoft Secure

MICROSOFT SECURE · Inside a Malicious Claude Code Extension and SSH Backdoor

Copy link to “Malicious Cursor Extension Installs Persistent SSH Backdoor”

The wire, last 30 days

This edition has 3 stories rated critical or elevated (P0 or P1); the 21 daily editions from 2 Oct to 30 Oct averaged 3.8. 8 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
31 Oct (this edition)1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200
9 Oct1310
8 Oct2300
7 Oct1310
6 Oct1310
5 Oct2210
2 Oct1220

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Chromium CVE-2026-118329 Improper Input Validation in ANGLE Security Update

Microsoft reports for Chromium ANGLE, citing improper input validation. The advisory comes from the Microsoft Security Response Center and is hosted in the Security Update Guide.

5 reports

Chainalysis Data Breach Involves Offensive Agentic Techniques

Chainalysis disclosed a security incident after attackers used offensive agentic techniques to access internal systems. Accessed data include user IDs, full names, email addresses, and organizational role labels; investigators say no evidence of investigation content or credentials exposure. External experts are assisting; LLMs are used for security review.

2 reports

Also reported

End of the Saturday, October 31, 2026 edition.

Colophon

SitRep · Vol. 1, No. 39

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.