Daily digest,
Ivanti Connect Secure Zero-Day Exploited: Urgent Patching Required (+5 more)
Vulnerabilities
Ivanti Connect Secure Zero-Day Exploited: Urgent Patching Required
Ivanti has disclosed a high-severity vulnerability, CVE-2026-104935, affecting its Connect Secure VPN, which allows unauthenticated remote attackers to execute arbitrary commands. The flaw has been actively exploited in the wild, with the earliest confirmed exploitation occurring on October 1, 2026. This vulnerability is part of a chain of three zero-days, with two flaws patched and one pending fix. Affected versions include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging immediate action from organizations. Ivanti recommends that affected customers update their systems to the latest versions and conduct forensic investigations to check for signs of compromise. The threat actor, tracked as UTA0576, has been observed executing commands and stealing credentials without leaving a backdoor. Reliable indicators of compromise are currently unavailable, complicating detection efforts.
Vulnerability · 17 sources · score 73 · CVE-2023-46805, CVE-2024-21887, CVE-2024-21893, CVE-2025-0282, CVE-2025-22457
Docker Hub Fixes Critical Vulnerability Allowing User Impersonation
Docker disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that allowed attackers to impersonate other users by misusing personal access tokens (PATs). The flaw, introduced on August 26, 2024, enabled an attacker to create an account, convert it into an organization, and reassign a PAT to a target user without their consent. This could allow the attacker to pull, push, or delete images in the target's repositories. Docker confirmed no evidence of exploitation after reviewing 304,000 pushes made with transferred tokens. The vulnerability was fixed on September 30, 2026, and affected users were notified on October 2, 2026. Docker has since changed its process to require user consent for such account conversions. The flaw has a CVSS score of 9.4, indicating its critical nature.
Vulnerability · 3 sources · score 70 · CVE-2026-105445, GhostPat
Container Vulnerability Scanners: Key Insights for 2026
In 2026, container vulnerability scanning has become as 82% of users run Kubernetes in production. The top tools include Trivy, Grype, Snyk Container, and Docker Scout, each offering unique features and pricing structures. The rise of Software Bill of Materials (SBOM) requirements and supply-chain security has made vulnerability scanning essential. CVE-2026-80521, a high-severity vulnerability published on August 26, 2026, highlights the importance of these tools in identifying risks within container images. Organizations must adapt their security practices to address the complexities of modern containerized applications. The comparison of these tools assists teams in selecting the right scanner based on their specific needs and constraints.
Vulnerability · 3 sources · score 58 · CVE-2026-80521, Nx Console Compromise
RCE Vulnerability in Visual Studio Copilot and SSMS Exploited via Trailing Dot
A Remote Code Execution vulnerability (CVE-2026-103572, CVSS 8.8) was discovered in Microsoft Visual Studio Copilot and SQL Server Management Studio, allowing attackers to bypass security controls using a trailing dot in filenames. The flaw, reported in August 2026, arises from a path validation bypass that enables arbitrary command execution. Microsoft released a patch on October 13, 2026, to address the issue. The vulnerability allows an attacker to manipulate Copilot's AI model, leading to potential exploitation through indirect prompt injection. Despite confirming the vulnerability, Microsoft awarded no bounty to the researcher, marking the third unrewarded report in two months. Developers are advised to patch their systems promptly to mitigate risks associated with this vulnerability.
Vulnerability · 2 sources · score 58 · CVE-2026-103572
Breaches
Cyberattack Disrupts Refrigeration at Major French Supermarkets
On October 10, 2026, major French supermarket chains, including E.Leclerc, Intermarche, and Cooperative U, were hit by a cyberattack that caused refrigeration systems to malfunction, leading to food spoilage. The attack reportedly targeted systems from Danish manufacturer Danfoss, with at least 300 Intermarche stores and over 100 Cooperative U outlets affected. Hackers managed to remotely trigger defrosting in refrigeration units, raising food safety concerns. E.Leclerc confirmed that a refrigeration equipment supplier was compromised, while Danfoss acknowledged vulnerabilities in its legacy products. France's cybersecurity agency is investigating the incident, which has drawn attention from EU officials regarding food security. Affected systems include outdated models that no longer receive security updates. As of now, authorities are working to identify the vulnerabilities exploited and mitigate further risks.
Other Threats · 2 sources · score 65
Threat actors and malware
Phishing Attacks Exploit Microsoft Teams for Credential Theft
In 2026, attackers increasingly impersonated IT support via Microsoft Teams to steal credentials and spread malware. Ontinue's report noted that 30% of monitored organizations experienced such impersonation attempts, with one in every 990 external contacts showing signs of fraud. The Shai-Hulud npm worm was identified as a significant threat, targeting developer credentials to propagate through the software supply chain. Additionally, device-code phishing attacks were confirmed across various sectors, allowing attackers to obtain refresh tokens and manipulate legitimate authentication methods. The report indicates that these tactics are becoming more common, leveraging trusted identities and services to gain unauthorized access. Organizations are urged to enhance security awareness and training to defend against these social engineering tactics.
APT · 2 sources · score 62 · ShinyHunters, Black Basta, ClickFix, Shai-hulud
New on leak sites
53 victims listed on ransomware leak sites by 18 groups in the 24 hours before this issue. The most active:
Also moving
- CVEs: CVE-2026-102255, CVE-2026-105133, CVE-2026-105134, CVE-2026-21589, CVE-2026-85097
- APT groups: ShinyHunters, Volt Typhoon
- Malware: Shai-hulud, Anubis, BDarkRAT, BPFDoor, ClickFix
- Ransomware groups: Qilin, The Gentlemen, Akira, Black Basta, Chaos
- Campaigns: SlugFest
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.