Max-severity OT bug under active exploitation, plus two exploited Ivanti flaws added to CISA's KEV
Monday brought an actively exploited flaw in a widely used industrial programming tool, a federal remediation order for Ivanti Connect Secure, a run of high-severity Chrome fixes, and a million-device Android TV botnet takedown.
The Register reported that a max-severity bug in a widely used OT programming tool is being exploited to deliver Linux malware. The Register's framing points at industrial IoT gateways. Treat any internet-reachable OT engineering or programming workstation as in scope, isolate it from general network access, and watch for unexpected Linux binaries or outbound connections from OT hosts.
Help Net Security reported that CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog on Friday, after Ivanti updated an earlier advisory, and that flaws were chained to gain a foothold. If you run Ivanti Connect Secure, apply Ivanti's fixed release per its advisory and hunt for signs of exploitation now; CISA's listing means these are being used in the wild.
Google's advisory lists several high-severity Chrome fixes. Google lists CVE-2026-119263 and CVE-2026-119261, both CVSS 9.6, as fixed in Chrome 156.0.8078.79. Google separately lists CVE-2026-118355, CVE-2026-118342 and CVE-2026-118340 at CVSS 9.6, plus CVE-2026-118337 at CVSS 9.3, as fixed in Chrome 156.0.8078.73. All are network-reachable and require user interaction. Update Chrome to the listed builds and confirm your fleet has restarted to apply them.
On takedowns, both The Register and BleepingComputer reported that police and Google, with industry partners, dismantled a botnet of more than 1.3 million infected Android TV boxes; BleepingComputer named the malware XCPE and reported Google banned the manufacturer, which it says intentionally infected the devices. The Register named Videostrong as accused of shipping devices with a backdoor.
On thefts and breaches: The Record reported more than $46 million left Brazil's Mercado Bitcoin per blockchain security firms; The Record reported Polymarket will return $3.9 million to victims of an October 29 compromise; The Record reported the BYOD ransomware gang claimed a Michigan State University incident; BleepingComputer reported Abrigo restored its Sageworks application after "irregular activity"; The Register reported a cloud-hosted AI workflow tool had environment variables stolen; and The Record reported Russia's Rosstat confirmed a cyberattack claimed by Belarusian and pro-Ukrainian hackers.
Sources
- The Register — Max-severity bug in widely used OT programming tool exploited to deliver Linux malware
- The Record — Largest crypto exchange in Brazil confirms cyberattack as millions flow out of platform
- BleepingComputer — Chinese hackers use ARTEX AI in automated attacks against 200 orgs
- The Hacker News — ⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More
- Help Net Security — CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)
- SecurityWeek — Cybersecurity M&A Roundup: 37 Deals Announced in October 2026
- Schneier on Security — AI Vulnerability Finding
- The Record — Michigan State cyber incident claimed by ransomware gang behind recent hospital attack
- The Register — Cops bust botnet of 1.3M infected Android TV boxes
- BleepingComputer — Fintech platform Sageworks taken offline after suspected cyberattack
- BleepingComputer — Google disrupts million-device XCPE Android malware botnet, bans TV box maker
- The Record — Polymarket pledges to give $3.9 million back to victims after site compromise
- The Register — Cloud-hosted AI workflow tool has environment variables snatched in security incident
- The Record — Russia's statistics agency confirms cyberattack claimed by Belarusian and Ukrainian hackers