Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

thehackernews.com Oct 31, 2026

Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

Curated by Shubham · TechCapsules · Oct 31, 2026

AI-summarised brief · reviewed before publication

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two Ivanti Connect Secure (ICS) flaws to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The vulnerabilities—CVE‑2026‑111357 and CVE‑2026‑118527—were part of a three‑step exploit chain first detailed by Volexity, which combined an authentication bypass (CVE‑2026‑104935, CVSS 8.6), a remote code execution flaw, and a local privilege escalation to achieve unauthenticated root‑level code execution. Threat actor UTA0576 used the chain to harvest credentials, query Active Directory metadata, and locate administrator passwords and BitLocker keys, rather than merely deploying malware. Ivanti released patches for all three CVEs; the authentication bypass fix was already in QA, while the LPE patches were rolled out in the latest release. Federal Civilian Executive Branch agencies must apply the fixes by early November 2026.

💡 Why It Matters

· The chain demonstrates how attackers can stitch together multiple bugs to bypass authentication entirely, turning routine VPN appliances into gateways for deep network reconnaissance.

Capsules Cybersecurity

Read full article on thehackernews.com

Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%

Cloudflare reported that it autonomously mitigated 18.2 million network‑layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in Q3 2026, up 38% from the previous quarter. The company logged 8,226 L3 attacks per hour, averaging one every 0.44 seconds, with short‑burst, low‑bandwidth attacks under 10 minutes and 1 Gbps rising 208%. Hyper‑volumetric attacks above 1 Tbps fell 69%, while DNS amplification surged 215%. Targeted sectors included media, IT services, gambling, software, and telecoms, with the U.S., China, Indonesia, the U.K., and Türkiye most affected.

💡 The spike in low‑bandwidth, short‑burst attacks shows attackers shifting tactics to evade detection, underscoring the need for adaptive defense strategies.

thehackernews.com · Oct 31

Why Urgent Security Fixes Aren’t Fixed. Observe, Prove, Act, Confirm Gets Them…

A new approach called Safe Remediation, detailed in a white paper, addresses delays in applying critical security fixes by providing evidence that changes will not disrupt operations. The method follows four stages—Observe, Prove, Act, and Confirm—using existing data from vulnerability scans, IPS logs, and endpoint policies to test and validate proposed actions in a controlled environment. After approval, changes are deployed through existing management tools, and confirmation records verify successful implementation. Across surveyed organizations, the process achieved a 99.5% success rate, blocking over 703 million attacks within a month.

💡 By turning evidence into a mandatory step, the framework reduces the hesitation that keeps patches stalled, ensuring that security updates are applied swiftly without compromising business continuity.

thehackernews.com · Oct 31

WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours

WordPress Core versions 4.7 through 7.1.3 suffered a remote code execution flaw, identified by a CVSS score of 8.1, that exploits a race condition during full‑package upgrades. Patches were released on October 28, 2026, yet within 24 hours Wordfence logged 62,969 attack attempts, targeting the web‑accessible staging directory “wp‑content/upgrade.” Threat actors poll vulnerable paths such as “setup‑config.php” to hit the narrow execution window. Site owners are urged to upgrade to 7.1.4 immediately and monitor for suspicious PHP files or admin accounts.

💡 The rapid, high‑volume exploitation attempts demonstrate that even short‑lived race conditions can become global threats when attackers coordinate persistent polling. Prompt patching and vigilant monitoring are essential to prevent widespread server compromise.

thequantuminsider.com · Oct 31

Netpoleon India Partners With QNu Labs on Quantum-Safe Security

Netpoleon India has teamed with QNu Labs to broaden quantum‑safe cybersecurity offerings for Indian enterprises. The partnership merges QNu Labs’ QShield 2.0 platform—providing cryptographic risk profiling, operations, governance, and AI‑driven security—with Netpoleon India’s extensive channel partner and system integrator network. Together, they aim to help organizations in banking, government, defense, and telecommunications assess cryptographic exposure, enhance crypto‑agility, and prepare for quantum‑era threats. The collaboration underscores India’s push to strengthen indigenous quantum cybersecurity capabilities.

💡 By linking a cutting‑edge quantum‑safe platform with a wide distribution network, the deal accelerates practical readiness for quantum threats, positioning Indian enterprises to safeguard critical data before quantum computers can compromise current cryptographic systems.

thehackernews.com · Oct 31

TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them

TeamViewer has released version 15.83 to patch a critical remote‑code‑execution flaw (CVE‑2026‑111585) that allows a compromised host to attack the viewer in a remote‑control session. The vulnerability, rated 8.8/10, affects Full Client, Portable, and Android apps on Windows, Linux and macOS versions prior to 15.83. By exploiting a screen‑size integer overflow, a malicious host can crash the viewer’s TeamViewer and, on Windows, bypass OS defenses to execute arbitrary code. The attack requires only the victim’s acceptance of the session, no password or extra clicks, and works in the default configuration. The fix also addresses two additional high‑severity bugs, and users are urged to upgrade immediately; no known exploits or active attacks have been reported.

💡 It flips the traditional attacker‑victim model, letting a remote device seize control of the machine that connects to it, exposing a widely used support tool to direct code execution.

thehackernews.com · Oct 31

Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide

Chinese actors identified as Vapor Panda have deployed an ARTEX to compromise more than 200 organizations worldwide since October 17, 2026. The tool integrates DeepSeek and a model, orchestrating planner and worker agents that autonomously conduct reconnaissance, vulnerability discovery and lateral movement across web applications, cloud services, containers, Active Directory and VPN critical infrastructure. CrowdStrike confirmed post‑exploitation at nine victims, where the group installed the BLOODALCHEMY malware, a ShadowPad variant, and carried out credential‑spraying and network scanning. Human operators intervene only to direct agents to create web shells, harvest domain‑admin passwords and evade endpoint defenses. The global campaign targets foreign government ministries, semiconductor firms, defense contractors, think tanks and telecom providers across Latin America, Europe, Asia, the Middle East and the United States.

💡 By automating multi‑vector attacks with AI, a single adversary can breach dozens of high‑value targets simultaneously, reshaping the scale and speed of state‑backed cyber espionage.