CISA flags active exploitation of Ivanti Connect Secure and GitLab as China-nexus crews root firewalls and servers

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog on 29 October based on evidence of active exploitation, its advisory says. One is a missing-authentication flaw in Ivanti Connect Secure; the other is an integer-overflow flaw in GitLab Community Edition and Enterprise Edition. CISA states that Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritise rapid remediation of catalogue entries. If you run Ivanti Connect Secure or GitLab, match your versions against each vendor's advisory and patch on that schedule.

Help Net Security reported that China-nexus threat actors chained the PHP2Shell flaws with the "Fragnesia" Linux kernel bug to root servers and firewalls, and exploited a VMware ESX zero-day to hide their tracks. The Register reported that suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers. The Record reported that one firm listed a half-dozen PHP2Shell exploitations and another identified a suspected Chinese campaign that breached US "government affiliated" servers. Help Net Security also reported that Cisco has confirmed attackers are crashing its firewalls using a newly disclosed vulnerability.

BleepingComputer reported that an APT group tracked as UAT-11473 is exploiting an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers to deploy custom malware called KeyDrift. If you operate Cisco SD-WAN controllers or firewalls, review Cisco's advisories.

Google's Chrome advisory covers a fixed release, 156.0.8078.73. Among the flaws fixed are CVE-2026-118355, CVE-2026-118342, CVE-2026-118340 and CVE-2026-118332, each rated 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), and CVE-2026-118337 and CVE-2026-118333, each rated 9.3. All affect Chrome up to the fix in 156.0.8078.73. Update Chrome to the release Google names in its advisory.

On supply-chain and crypto, BleepingComputer reported Binance is probing a potential breach of up to $5.8 billion; that Polymarket halted trading after a third-party service was compromised to distribute crypto-draining JavaScript, with about $2.5 million traced; that a Japan Airlines breach at Amadeus's Passenger Service System exposed about 92,000 customers' data; and that a Hugging Face crypto-mining campaign returned, with one malicious model downloaded over 28,000 times. The Register reported researchers found bugs in five AI developer tools, with OpenAI and Microsoft flaws still unpatched.