ITsecurity Daily
Daily Briefing
CISA flags two actively exploited Ivanti Connect Secure flaws; Anthropic researchers build remote-root Linux MPTCP exploit
Good morning. CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities Catalog on 30 October, based on evidence of active exploitation. CISA's alert describes the two as a missing-authentication-for-critical-function flaw and a predictable-identifier generation flaw in Ivanti Connect Secure. CISA states these vulnerability types are a frequent attack vector for malicious cyber actors, and that Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritise rapid remediation of KEV entries. If you run Ivanti Connect Secure, treat remediation as an active-exploitation priority.
BleepingComputer reported that security researchers at Anthropic developed an exploit for a critical Linux kernel vulnerability that lets unauthenticated attackers remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. Inventory hosts with MPTCP listeners exposed to untrusted networks and track the kernel vendor's patch.
Google's advisory lists six critical Chrome vulnerabilities fixed in the stable channel. CVE-2026-119263 and CVE-2026-119261, both carrying a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H and a base score of 9.6, affect Chrome up to the fix in 156.0.8078.79. CVE-2026-118355, CVE-2026-118342 and CVE-2026-118340 share the same vector and 9.6 score and are fixed in 156.0.8078.73. CVE-2026-118337, scored 9.3 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, is fixed in the same 156.0.8078.73 build. Update Chrome to the versions Google names.
Zoom out: BleepingComputer, The Hacker News and The Register each reported AI-assisted offensive activity the same day — Anthropic's MPTCP exploit, CrowdStrike's attribution of the ARTEX framework to Chinese actors, and a criminal's spending on AI services in extortion attacks.
Vulnerability in focus
CVE-2026-119263 — Google. CVSS 9.6
Affected: chrome.
What to do: Follow the vendor advisory for the fixed release and any interim mitigation.
Elsewhere
- The Hacker News: A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats Read it
- BleepingComputer: Critical Linux kernel flaw allows remote root attacks on MPTCP servers Read it
- BleepingComputer: Linux kernel exploit enables remote root attacks on MPTCP servers Read it
- The Register: Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see Read it
- The Record: Fashion retailer Resolve says hackers stole payment card information Read it
- CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog Read it
- The Register: GM cracks the petty cash box for multistate driver tracking settlement Read it
- The Hacker News: WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours Read it
- The Hacker News: TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Read it
- The Register: Anthropic: That Claude Code extension compromise… couldn't be us Read it
- BleepingComputer: Trezor warns of suspected crypto-theft implant in hardware wallet Read it
More from the desk
Sources
- Critical Linux kernel flaw allows remote root attacks on MPTCP servers BleepingComputer
- DOJ raises privacy concerns over potential sale of Character.AI chats The Record
- Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see The Register
- Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide The Hacker News
- PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress SecurityWeek
- Assad regime hacker who caused $136 billion market drop sentenced to 42 months Help Net Security
- CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA
- Linux kernel exploit enables remote root attacks on MPTCP servers BleepingComputer
- Fashion retailer Resolve says hackers stole payment card information The Record
- GM cracks the petty cash box for multistate driver tracking settlement The Register
- Anthropic: That Claude Code extension compromise… couldn't be us The Register
- Trezor warns of suspected crypto-theft implant in hardware wallet BleepingComputer
- Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach The Record
- TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them The Hacker News
Share this issue
Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky
Every briefing is on the site, with the advisory record behind it. All briefings