VulnHub

CISA has alerted organizations about a newly exploited vulnerability in Ivanti Connect Secure, identified as CVE-2026-104935. This authentication bypass flaw affects several versions of the software, including 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Attackers are actively exploiting this zero-day vulnerability to execute arbitrary commands remotely, leading to potential credential theft and data exfiltration. CISA advises affected organizations to update their systems immediately to the latest version as specified in Ivanti's security advisory. For organizations concerned about possible exploitation, CISA recommends conducting thorough network and memory forensics and following specific recovery procedures, including resetting configurations and passwords.

Swann Communications has reported vulnerabilities in their SWIFI-SE2KIC camera firmware versions 2.0.22 and earlier that could allow unauthorized access to live video feeds. Specifically, attackers on the same local network could exploit these issues to view video streams or snapshots without needing to authenticate. This situation poses a significant risk, particularly for users who might expose their cameras to the internet. To mitigate these vulnerabilities, Swann recommends keeping the camera behind a secured router and firewall, avoiding direct internet exposure, and ensuring that all devices are updated with the latest firmware. Users should also utilize strong, unique passwords for their router and accounts to enhance security.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities Catalog, indicating that they are currently being exploited in the wild. The first, CVE-2026-96951, is a command injection vulnerability in Microsoft Windows, while the second, CVE-2026-104935, is an authentication bypass vulnerability in Ivanti Connect Secure. These vulnerabilities are particularly concerning for federal agencies, as they can allow attackers to gain total control over affected systems. CISA has emphasized the need for rapid remediation of these high-risk vulnerabilities under its Binding Operational Directive 26-04, which sets guidelines for federal agencies to prioritize security updates based on risk. While the directive primarily targets federal agencies, CISA encourages all organizations to adopt similar practices to enhance their cybersecurity posture.

A recent report by Socura reveals that around 20% of Chief Information Security Officers (CISOs) are opting to take sick leave or vacation during Patch Tuesday, a day when many software vendors release critical security updates. This trend suggests a growing anxiety among security leaders about the workload associated with these updates, which can be overwhelming due to the number of patches that need to be applied. The report indicates that this avoidance behavior may stem from the stress of managing vulnerabilities and potential threats that come with these updates. This situation raises concerns about the overall security posture of organizations, as skipping these updates can leave systems vulnerable to exploitation. It emphasizes the need for better resource management and support for security teams to ensure they can effectively handle patching responsibilities.

On October 11, attackers gained remote access to refrigeration units in hundreds of French supermarkets, raising the temperature of fridges and freezers to as high as 50°C. This incident forced several retail chains, including Les Mousquetaires, to discard large quantities of food, leading to significant financial losses. The attackers exploited vulnerabilities in the Danfoss controllers that manage these cooling systems, which are typically accessed by maintenance companies remotely. This incident raises serious concerns about the security of IoT devices used in commercial settings, as it demonstrates how a cyber attack can directly impact food safety and waste. Retailers are now urged to reassess their security measures for critical infrastructure to prevent similar incidents in the future.

Progress Software disclosed two serious vulnerabilities in its MarkLogic Server database that could allow users with limited management privileges to gain full administrator access. This issue is part of a larger set of 31 flaws announced on October 12, with five classified as critical. The vulnerabilities affect versions 11.3.7 and 12.1.0 of MarkLogic, and fixes have been available since September 10. Organizations using these versions should prioritize applying the updates to prevent unauthorized access and potential data breaches. Failure to address these vulnerabilities could leave systems open to exploitation by malicious actors.

Recent findings reveal that low-cost Android smartphones, particularly those using MediaTek platforms, are being shipped with preinstalled malware known as Midnight Mimosa. This malicious software enables attackers to covertly install additional applications, engage in ad fraud, and convert the devices into residential proxies. The issue affects various smartphone brands that utilize these MediaTek platforms, posing a significant risk to users' privacy and security. The presence of malware at the firmware level complicates detection and removal, leaving many users unaware that their devices are compromised. This incident raises concerns about the security practices of manufacturers and the potential for widespread exploitation of infected devices.

The U.S. government has disrupted a cyber operation known as FAMOUS CHOLLIMA, which is linked to North Korean hackers. This operation was targeting various sectors, including finance and critical infrastructure. The disruption was made possible with the assistance of CrowdStrike, a cybersecurity firm that provided expertise in identifying and mitigating the threat. The importance of this action lies in its potential to protect sensitive information and prevent financial losses that could arise from such attacks. This incident illustrates the ongoing risk posed by state-sponsored cybercriminals and the need for constant vigilance in cybersecurity efforts.

SonicWall customers are facing a serious security issue as attackers exploit a maximum-severity Server-Side Request Forgery (SSRF) vulnerability in their SMA 1000 appliances. This flaw allows unauthorized access to internal resources, potentially leading to data breaches and network compromises. Organizations using these devices need to act quickly to protect their networks, as the vulnerability is currently being targeted in the wild. SonicWall users should ensure their systems are updated and patched to mitigate the risks associated with this exploitation. The urgency of this situation emphasizes the need for businesses to maintain vigilance in securing their devices against emerging threats.