『Ivanti Zero-Day Chain Roots Patched VPNs; Microsoft Fixes 1,413 Bugs』のカバーアート

Ivanti Zero-Day Chain Roots Patched VPNs; Microsoft Fixes 1,413 Bugs

Ivanti Zero-Day Chain Roots Patched VPNs; Microsoft Fixes 1,413 Bugs

無料で聴く

ポッドキャストの詳細を見る
Ivanti Zero-Day Chain Roots Patched VPNs; Microsoft Fixes 1,413 Bugs Wednesday, October 14, 2026: An attacker chains three Ivanti Connect Secure zero-days to root (one still unpatched), Microsoft ships a record 1,413 fixes including an exploited Windows Shell bug, an AI-found Linux kernel flaw gives local users root, a "SlugFest" loophole left 1,500+ npm packages open to hijacking, and an OpenAI engineer is charged with bugging the executive conference room. 1. Three chained Ivanti zero-days give attackers root, and one's unpatched Volexity found attacker UTA0576 exploiting a fully patched Ivanti Connect Secure appliance (22.8R2.4) from October 3, chaining an authentication bypass and RCE to a privilege escalation for unauthenticated root. Ivanti has fixed the first two and confirms limited exploitation; the privilege-escalation fix is due in the coming weeks. Ivanti's Integrity Checker Tool misses the chain because changes are in memory only. The attacker stole stored LDAP credentials and password-sprayed Active Directory. CVEs: CVE-2026-104935 (CVSS 8.6, auth bypass + RCE); privilege escalation CVE not yet assigned publicly. Also in Ivanti's post: CVE-2026-106042 (Xtraction) and CVE-2026-109412 (Neurons Patch for Intune), not exploited. Do this today: upgrade Connect Secure to 22.8R2.5 or 25.1.3.x, hunt logs for floods of requests to /dana-na/auth/url_default/welcome.cgi with a mismatched X-DSCGI-PATH header, check for /data/.icscap/ and traffic to 108.165.147[.]64, and rotate credentials stored on the appliance. Source: The Hacker News 2. Microsoft just patched fourteen hundred thirteen bugs in one day October Patch Tuesday fixed a record 1,413 vulnerabilities, topping September's near-1,000. One is exploited in the wild: a Windows Shell command injection that bypasses Mark of the Web (CISA KEV deadline October 16). A .NET Framework WDAC bypass was publicly disclosed, and a CVSS 9.8 Raw Image Extension bug triggers on thumbnail preview. CVEs: CVE-2026-96951 (exploited), CVE-2026-108398 (publicly disclosed), CVE-2026-92707, CVE-2026-21413 (CVSS 9.8) Do this today: push the October cumulative update to every Windows 10 and 11 machine, starting with users who open email attachments. Sources: The Hacker News, Krebs on Security 3. An AI-found Linux bug hands local users root Tencent Zhuque Lab's Corvus AI pipeline found "Vghost" in the kernel's vhost subsystem: a stale translation cache gives an unprivileged user deterministic kernel read/write and root on kernels 4.11 through 7.2-rc4. With a virtual IOMMU and device-IOTLB mode, an untrusted guest can write into the host's QEMU process. Red Hat, Amazon Linux, and Oracle Linux have fixes; Ubuntu 24.04 and 26.04 are in progress. CVE: CVE-2026-74580 (CVSS 8.8 per kernel.org; vendor scores 7.3 to 7.8) Do this today: install a fixed kernel and reboot; until then, remove world access from /dev/vhost-net and /dev/vhost-vsock. Source: The Hacker News 4. A renamed GitHub repo could hand strangers your npm package Bloom Security's "SlugFest" research showed npm trusted publishing bound to a repository's owner/name slug rather than its immutable ID until the first publish, so an attacker who claimed a renamed, transferred, or deleted repo's slug could publish versions of someone else's package. Over 1,500 packages with 10 million+ downloads were exposed. GitHub now expires unvalidated trusted publisher configs after 48 hours and rejects tokens from issue_comment workflows. CVE: none Do this today: audit every npm trusted publisher binding; if the repo was renamed, transferred, or deleted, delete the binding and re-create it. Source: The Hacker News 5. An OpenAI engineer allegedly bugged the executive conference room The FBI arrested OpenAI engineering lead Abdulrahman Alfozan on October 9 after staff found a concealed audio recorder plugged into a TV's USB port in an executive conference room. Prosecutors allege a chatbot account tied to his spouse was used for help building and encrypting the device. OpenAI says it sees no sign of exfiltrated weights, source code, or customer data. These are charges, not a conviction. CVE: none Do this today: sweep boardroom TVs and USB ports, restrict who can see executive calendars, and add conference rooms to your insider-threat checklist. Sources: The Hacker News, Wired More from Matt: https://www.mattchapman.net Kindle: https://www.amazon.com/dp/B0HHMH88H9 Apple Books: https://books.apple.com/us/book/local-ai-on-the-mac/id6807243472Barnes & Noble: https://www.barnesandnoble.com/w/books/1151622292?ean=2940185390764https://mattchSupport the show
adbl_web_anon_alc_button_suppression_t1
まだレビューはありません