Daily Briefing

Ivanti Connect Secure flaws under active exploitation added to CISA KEV; Google ships six high-severity Chrome fixes

By The IT Security Desk

Good morning. The Hacker News reported that CISA on Friday added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog following active exploitation in the wild, and that attackers are chaining three Ivanti Connect Secure flaws to gain unauthenticated root access. If you run Ivanti Connect Secure, treat this as your first priority: a KEV listing means CISA has confirmed exploitation in the wild, so match your appliances against the two flaws CISA listed and remediate.

Google's Chrome advisories cover six flaws for defenders to patch. Google lists CVE-2026-119263 and CVE-2026-119261, both CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (base 9.6), fixed in Chrome 156.0.8078.79. Google also lists CVE-2026-118355, CVE-2026-118342 and CVE-2026-118340, each the same vector and 9.6, plus CVE-2026-118337 at CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (base 9.3), all fixed in Chrome 156.0.8078.73. Follow Google's advisory for the fixed release and any interim mitigation.

BleepingComputer reported a security researcher has released a proof-of-concept for a recently patched Android vulnerability dubbed "SMS of Death" that lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message; apply your Android patches. BleepingComputer also reported that researchers at Anthropic developed an exploit for a critical Linux kernel flaw allowing unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners — review MPTCP exposure.

Read the full briefing →

Zoom out: Several of the day's items — Chainalysis, the ChatGPT share-link flaw and an extortion operation — turned on attackers' use of AI tooling and "agentic" techniques.

Vulnerability in focus

CVE-2026-119263 — Google. CVSS 9.6

Affected: chrome.

What to do: Follow the vendor advisory for the fixed release and any interim mitigation.

Elsewhere

BleepingComputer: New Android SMS of Death exploit can remotely crash unpatched phones Read it
BleepingComputer: From Beginner to Bug Hunter: Learning Cybersecurity in the AI Era. Read it
SecurityWeek: Syrian Hacker Gets Prison Time in US After Over a Decade on the Run Read it
The Hacker News: Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access Read it
The Hacker News: A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats Read it

Sources

Northflank security breach leads to abuse of customers' AI API keys BleepingComputer
Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data The Hacker News
Syrian Hacker Gets Prison Time in US After Over a Decade on the Run SecurityWeek
DOJ raises privacy concerns over potential sale of Character.AI chats The Record
Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see The Register
New Android SMS of Death exploit can remotely crash unpatched phones BleepingComputer
From Beginner to Bug Hunter: Learning Cybersecurity in the AI Era. BleepingComputer
Chainalysis discloses data breach from "offensive agentic techniques" BleepingComputer
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access The Hacker News
A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats The Hacker News
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38% The Hacker News
Critical Linux kernel flaw allows remote root attacks on MPTCP servers BleepingComputer
Linux kernel exploit enables remote root attacks on MPTCP servers BleepingComputer
Fashion retailer Resolve says hackers stole payment card information The Record

Share this issue

Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky

Every briefing is on the site, with the advisory record behind it. All briefings