Wednesday, October 14, 2026 · Daily editionBack issueBack issues · Search

SitRep

An independent cybersecurity briefing — what matters, with its sources.

You are reading a back issue. Go to the latest edition →

The situation

Ivanti ICS Zero‑Day Patch Urgency

Patch now: authentication bypass exploited since Oct 1; apply updates and rotate credentials.

Composed by SitRep’s AI editors from 2 sources — BleepingComputer, The Hacker News

Ivanti Connect Secure Zero‑Day Exploited in the Wild

Ivanti Connect Secure (CVE-2026-104935) has been exploited in the wild since Oct 1. Ivanti released fixes for 22.8R2.5, 25[.]1[.]3[.]0, 25[.]1[.]3[.]1, and 25[.]1[.]1[.]2. The widespread patch cycle mirrors Microsoft’s record Patch Tuesday with 1,414 fixes, underscoring broad exposure. Federal guidance and vendor advisories emphasize rapid upgrades to mitigate unauthenticated code execution and credential compromise.

Context

Two appliance‑level flaws are being actively exploited to seize management access, expanding risk to VPNs and perimeter devices. Exposed management planes, perimeters, and integrated apps (Nextcloud/Collabora) should be top targets for hunt and mitigation, as compromises enable lateral movement and credential theft.

“Patch, audit, and revoke credentials now to break attacker chains before credential harvesting or device implants lead to persistent access.”
The move

5 things to do today

  1. Patch Ivanti Connect Secure (CVE-2026-104935) immediately to 22.8R2.5, 25[.]1[.]3[.]0, 25[.]1[.]3[.]1 or 25[.]1[.]1[.]2; rotate certificates and passwords used by the appliance and run memory forensics.
  2. Apply PAN‑OS updates that address CVE-2026-0322 across 10.2/11.1/11.2/12.1/12.2, block management-plane access from untrusted networks, and enforce MFA for administrative access.
  3. Upgrade Collabora Online to 26.4.303+ or remove the richdocumentscode app from Nextcloud instances (especially Nextcloud ≤29) and scan for web shells and anomalous web processes.
  4. Quarantine Ledger inventory in Southeast Asia and Hong Kong for hardware implants; require reseller provenance and halt affected device sales until integrity is confirmed.
  5. Hunt for credential reuse and compromised cloud accounts using takedown indicators; reset exposed accounts and tighten onboarding and MFA enforcement to remove initial access vectors.

On the wire

P0Exploit

Immediate Patch and Remediation for Ivanti Connect Secure CVE-2026-104935

CVE-2026-104935 enables unauthenticated code execution and has been exploited since Oct 1; Ivanti published fixes for 22.8R2.5, 25[.]1[.]3[.]0, 25[.]1[.]3[.]1 and 25[.]1[.]1[.]2 and federal agencies have an Oct 16 deadline. Apply vendor updates immediately, rotate passwords and certificates used by ICS, take configuration backups, and perform memory forensics and IOC hunting for signs of pre‑patch compromise.

BLEEPINGCOMPUTER · CISA Urges Patch for Ivanti Connect Secure Zero-Day

P0Exploit

Patch PAN‑OS CVE-2026-0322 and Restrict Management-plane Access

Palo Alto Networks reports active exploitation of PAN‑OS management interface (CVE-2026-0322) affecting PA‑Series, VM‑Series and Panorama appliances; fixes available across 10.2, 11.1, 11.2, 12.1 and 12.2 (11.2.16 due Oct 15). Prioritize applying PAN‑OS updates, block management access from untrusted networks, enforce MFA for management, and search appliance logs for anomalous commands.

BLEEPINGCOMPUTER · PAN-OS RCE Flaw CVE-2026-0322 Exploited in Attacks

P1RCE

Upgrade or Remove Collabora CODE Server to Stop Nextcloud web‑shell Installs

CVE-2026-110447 allowed unauthenticated command execution via the built-in CODE server and led to web shells on Nextcloud; Collabora fixed the issue in 26.4.303. Upgrade Collabora to 26.4.303+ or remove the richdocumentscode app, and hunt Nextcloud instances for web shells and suspicious web processes.

THE HACKER NEWS · Hackers Backdoor Nextcloud via Collabora Built-in CODE Server Flaw

P2Supply Chain

Quarantine and Audit Ledger Devices After supply‑chain Implant Discovery

Ledger reports CryptoBilis‑modified devices that exfiltrate seeds; resellers in Southeast Asia and Hong Kong halted sales; quarantine regional inventory, require provenance checks, notify customers, and work with suppliers to verify integrity.

BLEEPINGCOMPUTER · Ledger Halts Asia Sales After Supply-Chain Wallet Implant

P3Phishing

Leverage Phishing Takedown Intelligence to Hunt and Reset Exposed Accounts

Law enforcement disrupted ~1 billion phishing messages; prioritize credential resets, inspect cloud accounts for abuse, and tighten mail‑filtering and onboarding controls to reduce reuse of compromised credentials.

BLEEPINGCOMPUTER · Global Takedown Disrupts Network Behind 1 Billion Phishing Messages

Indicators named in this edition

KindValueNote
CVECVE-2026-104935Ivanti Connect Secure authentication bypass; exploited in the wild since Oct 1
CVECVE-2026-0322PAN‑OS remote code execution affecting PA/VM/ Panorama appliances
CVECVE-2026-110447Collabora Online CODE Server unauthenticated command execution leading to web shells

Elsewhere in the edition

Microsoft Patch Tuesday Fixes 1,413 Vulnerabilities, Includes Exploited Windows Zero-Day

Microsoft’s October 2026 Patch Tuesday patches a record 1,413 CVEs, including 1,102 Windows, 134 Office, 61 developer tools, and 36 SharePoint Server flaws. The exploited zero-day is CVE-2026-96951, a Windows shell feature bypass enabling MotW evasion. Additional fixes include CVE-2026-108398 and CVE-2026-92707; CISA added the zero-day to KEV.

5 reports

FBI Arrests DPRK Laptop-Farm Operators in Texas Under Lonestar Roundup

The DoJ disrupted the Famous Chollima operation, arresting two U.S. nationals and charging 14 others. About 187 company-issued laptops and KVM devices were seized from 40 suspected laptop-farm residences during Sept. 21–25 in Texas. The operation, named Lonestar Roundup, targeted DPRK IT-workers who used stolen or fake identities to appear U.S.-based and funnel earnings to DPRK accounts; Ohio-ind…

4 reports

Cisco Warns Active Attacks Exploit Critical Secure Email Gateway Vulnerability

Cisco warns of active exploits abusing a critical Secure Email Gateway flaw, CVE-2026-76519, enabling a non-logged-in sender to write files as root. Requires File Reputation enabled and an older Content Scanner Tools (pre-25.3.0.5525). Fixes shipped in AsyncOS 15.5.5-014 and 16.5.0-780; update or enable automatic updates to mitigate.

3 reports

OpenAI Employee Arrested for Alleged Hidden Recorder in Conference Room

A Saudi national OpenAI employee, Abdulrahman Alfozan, was arrested Oct 9, 2026, on charges of using a hidden recording device to covertly capture discussions in OpenAI’s San Francisco executive conference room. The device was found Sept 30, 2026, concealed in a USB port behind a TV. FBI and OpenAI describe the case as insider threat; potential penalties include up to 5 years in prison and a $250…

3 reports

Anthropic Warns Small AI Models Could Self-Replicate Through IoT Devices

Anthropic warns that small AI models could self-replicate on IoT devices, potentially creating autonomous worms. By next year, smaller models may run on inexpensive hardware like Android TV boxes; researchers used quantization and shards to enable inference. An AI worm could carry model weights as payload and re-download them, making takedown difficult and potentially faster than traditional malw…

3 reports

Hirudo Android Malware Replaces Banking Apps to Evade Checks

Hirudo Android malware replaces legitimate banking apps with patched copies to bypass security checks, using a hooking engine built on YAHFA and Dobby. It spoofs certificates, hides Accessibility services, and can capture screenshots, record audio, stream screens, and steal credentials. Delivered via loader apps (Shopora, 1V1 X, ZoyaTV, KoiShort), it targets Indonesian banks and financials in Chi…

2 reports

Also reported

End of the Wednesday, October 14, 2026 edition.