Today's outlook

CISA flags two actively exploited Ivanti Connect Secure flaws; Anthropic researchers build remote-root Linux MPTCP exploit

By The IT Security Desk

Good morning. CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities Catalog on 30 October, based on evidence of active exploitation. CISA's alert describes the two as a missing-authentication-for-critical-function flaw and a predictable-identifier generation flaw in Ivanti Connect Secure. CISA states these vulnerability types are a frequent attack vector for malicious cyber actors, and that Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritise rapid remediation of KEV entries. If you run Ivanti Connect Secure, treat remediation as an active-exploitation priority.

BleepingComputer reported that security researchers at Anthropic developed an exploit for a critical Linux kernel vulnerability that lets unauthenticated attackers remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. Inventory hosts with MPTCP listeners exposed to untrusted networks and track the kernel vendor's patch.

Google's advisory lists six critical Chrome vulnerabilities fixed in the stable channel. CVE-2026-119263 and CVE-2026-119261, both carrying a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H and a base score of 9.6, affect Chrome up to the fix in 156.0.8078.79. CVE-2026-118355, CVE-2026-118342 and CVE-2026-118340 share the same vector and 9.6 score and are fixed in 156.0.8078.73. CVE-2026-118337, scored 9.3 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, is fixed in the same 156.0.8078.73 build. Update Chrome to the versions Google names.

SecurityWeek reported that over 22.6 million exposed instances are potentially affected by critical PHP flaws targeted for over a week, and that PHP2Shell attacks root Palo Alto firewalls but fail against WordPress.

The Hacker News reported that TeamViewer fixed a flaw that lets the controlled host in a session attack the viewer machine that connected to control it.

On breaches: The Record reported that Florida's Department of Education said 4.9 million people had Social Security numbers leaked in a Florida Student Financial Aid website breach it became aware of on 19 October; The Record reported that fashion retailer Resolve said a hack exposed customer payment card numbers; and BleepingComputer reported that Trezor received credible reports of a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia.