Ivanti Connect Secure auth bypass flaw added to CISA KEV catalog

🚨 ACTIVE EXPLOITATION

• Ivanti Connect Secure auth bypass vulnerability CVE-2026-104935 added to CISA KEV catalog CVE-2026-104935
  CISA has added an Ivanti Connect Secure authentication bypass vulnerability (CVE-2026-104935) to its KEV catalog with a patch deadline of October 16, 2026.
  • Affects Ivanti Connect Secure (formerly Pulse Secure) VPN gateway users; federal agencies must comply with CISA BOD 26-04 patching guidance
  • The flaw is an authentication bypass by spoofing that lets a remote, unauthenticated attacker execute arbitrary commands
  • CISA requires applying vendor mitigations and forensics triage, or discontinuing use of the product if mitigations are unavailable
  • Related Ivanti gateway flaws (CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, CVE-2024-21893) affect all supported 9.x and 22.x versions, with patches for Connect Secure 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, 22.5R1.1, 22.5R2.2 and Policy Secure 22.5R1.1
  • Prior exploitation included threat actors manipulating Ivanti's internal integrity checker tool (ICT) to hide compromise; Ivanti recommends running the external ICT instead
  Sources 📎 Coverage: securityweek.com · 👁 via CISA KEV

💥 BREACHES & INCIDENTS

• Hackers force French supermarket fridges to 50C in 'unprecedented' cyber-attack
  A cyber-attack remotely heated refrigerators at hundreds of French supermarkets to 50C, causing food losses and fires.

  • Affects major French retailers including Intermarché (~150 stores), Coopérative U, Carrefour (80 stores), Monoprix (5% of stores), and reportedly E.Leclerc, with similar issues at Dutch-Belgian Ahold Delhaize chains.
  • Connected refrigeration systems were remotely heated to 50C for six hours overnight, causing food losses and fires; losses estimated in the tens of millions of euros.
  • ANSSI identified a vulnerability in software from Danish firm Danfoss; affected units were running outdated firmware.
  • Store refrigeration control panels are internet-accessible, allowing remote maintenance — and remote attack; Claroty previously disclosed Danfoss AK-SM 800A controller vulnerabilities.
  • Analysts say Spain, Portugal, Poland, Germany and Belgium were also affected; similar disruptions hit about a dozen US military commissaries in late August.
  Sources 📄 Source: cyberplace.social · 📎 Coverage: cbc.ca · 👁 via @GossiTheDog@cyberplace.social

• Retail hacking spree hits UK fashion chains and Ahold Delhaize, disrupting grocery deliveries
  Cyberattacks have hit UK fashion retailers Phase Eight, Hobbs and Whistles and grocery giant Ahold Delhaize, forcing systems offline and disrupting deliveries.

  • UK fashion chains Phase Eight, Hobbs and Whistles, owned by TFG London, paused all online orders after a cybersecurity incident identified on Sunday; TFG's Inside Story and White Stuff brands are unaffected
  • Ahold Delhaize, which owns Albert Heijn, Delhaize, Food Lion, Stop & Shop, Giant Food, Hannaford and others, took systems offline to protect them after a network security issue
  • Albert Heijn's systems have been down since Sunday afternoon, halting online grocery deliveries and leaving some distribution centers at a standstill with empty shelves
  • H&M is separately investigating claims its systems were attacked but says it found no indications its data environment was compromised
  • The incidents follow a serious cyberattack on fashion giant ASOS roughly a week earlier
  Sources 📄 Source: bleepingcomputer.com · 📎 Coverage: metacurity.com · 👁 via @metacurity@infosec.exchange

🔓 CVEs & KEV

• CVE-2026-53709 — IBM mcp-context-forge — CVSS 9.8 — MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .en...

• CVE-2026-74041 — Wazuh wazuh-manager — CVSS 9.4 — Wazuh Manager Remote Root Command Injection via Config Validation Bypass

• CVE-2026-74040 — Wazuh wazuh-manager — CVSS 9.4 — Wazuh Cluster Worker File Overwrite Escalates to Root RCE

• CVE-2026-77099 — Commvault Cloud — CVSS 9.3 — CVFS Command ExecutionCVFS contained an input validation issue affecting comm...

• CVE-2026-39919 — Artifex Software Ghostscript — CVSS 9.3 — Critical Ghostscript Flaw Lets Attackers Use Malicious PDFs to Execute Code

• CVE-2026-97334 — Commvault Cloud — CVSS 8.7 — Network messaging layer decompression resource exhaustionThe network messagin...

• CVE-2026-77100 — Commvault Cloud — CVSS 8.7 — MediaAgent Denial of ServiceMediaAgent contained a heap-based buffer overflow...

• CVE-2026-77096 — Commvault Cloud — CVSS 7.7 — CVFS Missing AuthenticationCVFS contained a missing authentication condition ...

• CVE-2026-97333 — Commvault Cloud — CVSS 7.1 — QAPI stack-based buffer overflowQAPI contained a stack-based buffer overflow ...

• CVE-2026-77095 — Commvault Cloud — CVSS 7.1 — CvFWD Null Pointer DereferenceCvFWD contained a null pointer dereference affe...

• CVE-2026-77094 — Commvault Cloud — CVSS 7.1 — CvFWD Out-of-Bounds WriteCvFWD contained an out-of-bounds write affecting ser...

• CVE-2026-77093 — Commvault Cloud — CVSS 7.1 — CvFWD Denial of ServiceCvFWD contained an integer overflow affecting service ...

• CVE-2026-11732 — NETGEAR CAX30 — CVSS 6.3 — Insufficient input validation vulnerability exists in website blocking featur...

• CVE-2026-11731 — NETGEAR RAX30 — CVSS 6.3 — Authentication Bypass Vulnerability in Certain NETGEAR RAX Series ModelsAn au...

🕵️ RESEARCH & DEEP DIVES

• GitLab patches max-severity CVE-2026-97229 RCE flaw in CI/CD regex compiler CVE-2026-97229
  GitLab has patched a CVSS 10.0 unauthenticated remote code execution flaw (CVE-2026-97229) in its CI/CD Regular Expression Compiler.

  • Affects self-managed GitLab CE/EE versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2; GitLab.com is patched and Dedicated customers unaffected.
  • Integer overflow (CWE-190) in the CI/CD Regular Expression Compiler allows arbitrary code execution via a specially crafted regular expression in a CI/CD configuration.
  • Rapid7 reproduced the exploit on GitLab CE 19.4.1; the attacker must first commit a malicious .gitlab-ci.yml and a UTF-8 repository path to a branch in a public project, possible with an ordinary account where users can self-register and create projects.
  • No confirmed in-the-wild exploitation or public PoC as of October 13, 2026.
  • Flaw reported by researcher 'joaxcar' via GitLab's HackerOne bug bounty program.
  Sources 📄 Source: rapid7.com · 📎 Coverage: helpnetsecurity.com · 👁 via thehackerwire.com (discovered), rapid7.com (discovered)

• Check Point finds high-severity auth bypass and SSRF flaws in LiteLLM LLM gateway CVE-2026-35029 CVE-2026-59823
  Check Point Research uncovered multiple high-impact vulnerabilities in the LiteLLM LLM gateway, fixed in version 1.83.9.

  • Affects LiteLLM, a widely used open-source LLM gateway/proxy server; versions prior to 1.83.0 are vulnerable (research conducted against v1.77.7).
  • CVE-2026-35029: the /config/update endpoint lacks admin role authorization (CWE-425/863, CVSS 8.7-8.8), letting any authenticated low-privileged user modify proxy configuration and environment variables.
  • The flaw enables remote code execution via pass-through handlers pointing to attacker-controlled Python code, arbitrary file reads via UI_LOGO_PATH and /get_image, and admin account takeover by overwriting UI_USERNAME/UI_PASSWORD.
  • A UI token classification bypass routes litellm-dashboard team tokens to permissive route checks, allowing access to /config/update.
  • CVE-2026-59823: an SSRF in the 'Clientside LLM Credentials' feature lets attackers redirect API calls and exfiltrate provider API keys.
  Sources 📄 Source: github.com · 📎 Coverage: research.checkpoint.com · 👁 via Check Point Research

• �