Ivanti Connect Secure flaws under active exploitation added to CISA KEV; Google ships six high-severity Chrome fixes

The Hacker News reported that CISA on Friday added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog following active exploitation in the wild, and that attackers are chaining three Ivanti Connect Secure flaws to gain unauthenticated root access. If you run Ivanti Connect Secure, treat this as your first priority: a KEV listing means CISA has confirmed exploitation in the wild, so match your appliances against the two flaws CISA listed and remediate.

Google's Chrome advisories cover six flaws for defenders to patch. Google lists CVE-2026-119263 and CVE-2026-119261, both CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (base 9.6), fixed in Chrome 156.0.8078.79. Google also lists CVE-2026-118355, CVE-2026-118342 and CVE-2026-118340, each the same vector and 9.6, plus CVE-2026-118337 at CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (base 9.3), all fixed in Chrome 156.0.8078.73. Follow Google's advisory for the fixed release and any interim mitigation.

BleepingComputer reported a security researcher has released a proof-of-concept for a recently patched Android vulnerability dubbed "SMS of Death" that lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message; apply your Android patches. BleepingComputer also reported that researchers at Anthropic developed an exploit for a critical Linux kernel flaw allowing unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners — review MPTCP exposure.

On breaches: BleepingComputer reported Northflank is warning customers to rotate all credentials and secrets stored on its platform after a breach led to unauthorized use of customers' AI API keys — rotate now if you host there. BleepingComputer reported Chainalysis disclosed a breach from "offensive agentic techniques" exposing customer names, email addresses, user IDs and organizational roles; The Hacker News reported Chainalysis said the breach did not reach its investigation content, authentication credentials or session tokens. The Record reported fashion retailer Resolve said a hack exposed customer payment card numbers.

The Hacker News reported researchers at the security firm Parameter showed a malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it and read their private conversations; the researchers reported the flaw through OpenAI's bug bounty program on October 18 and OpenAI fixed it. The Hacker News also reported Cloudflare mitigated 18.2 million network-layer DDoS attacks in Q3, up 38%. SecurityWeek reported a US court sentenced Syrian hacker Ahmad Umar Agha to 42 months for pro-Assad attacks.