Today's outlook

Max-severity OT bug under active exploitation, plus two exploited Ivanti flaws added to CISA's KEV

By The IT Security Desk

Good morning. The Register reported that a max-severity bug in a widely used OT programming tool is being exploited to deliver Linux malware. The Register's framing points at industrial IoT gateways. Treat any internet-reachable OT engineering or programming workstation as in scope, isolate it from general network access, and watch for unexpected Linux binaries or outbound connections from OT hosts.

Help Net Security reported that CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog on Friday, after Ivanti updated an earlier advisory, and that flaws were chained to gain a foothold. If you run Ivanti Connect Secure, apply Ivanti's fixed release per its advisory and hunt for signs of exploitation now; CISA's listing means these are being used in the wild.

Google's advisory lists several high-severity Chrome fixes. Google lists CVE-2026-119263 and CVE-2026-119261, both CVSS 9.6, as fixed in Chrome 156.0.8078.79. Google separately lists CVE-2026-118355, CVE-2026-118342 and CVE-2026-118340 at CVSS 9.6, plus CVE-2026-118337 at CVSS 9.3, as fixed in Chrome 156.0.8078.73. All are network-reachable and require user interaction. Update Chrome to the listed builds and confirm your fleet has restarted to apply them.

On takedowns, both The Register and BleepingComputer reported that police and Google, with industry partners, dismantled a botnet of more than 1.3 million infected Android TV boxes; BleepingComputer named the malware XCPE and reported Google banned the manufacturer, which it says intentionally infected the devices. The Register named Videostrong as accused of shipping devices with a backdoor.

On thefts and breaches: The Record reported more than $46 million left Brazil's Mercado Bitcoin per blockchain security firms; The Record reported Polymarket will return $3.9 million to victims of an October 29 compromise; The Record reported the BYOD ransomware gang claimed a Michigan State University incident; BleepingComputer reported Abrigo restored its Sageworks application after "irregular activity"; The Register reported a cloud-hosted AI workflow tool had environment variables stolen; and The Record reported Russia's Rosstat confirmed a cyberattack claimed by Belarusian and pro-Ukrainian hackers.