Tonight’s response order is conditional, not sequential. Ivanti remains first because root-level exploitation, possible in-memory anti-forensics, an apparently unpatched escalation stage, and reported access to domain credentials, LAPS passwords, and BitLocker recovery keys all weaken confidence in appliance-local evidence and ordinary remediation. Cisco remains second for now, despite active exploitation, because a patch exists—but suspected compromise changes the task from upgrade to isolation, evidence preservation, and trusted rebuild. PAN-OS stays third only when exposure can be restricted immediately; an Internet-exposed instance without compensating controls rises alongside Cisco. Meanwhile, the Windows Shell KEV issue must be patched in a separate endpoint lane rather than waiting behind appliance work. The immediate play is to establish ownership and exposure, remove vulnerable services from public reach where feasible, freeze unnecessary changes, and preserve off-box and volatile evidence before remediation alters it.
Marcus has sharpened the trust-recovery point: after Cisco or Ivanti compromise, the appliance itself becomes an untrusted security boundary, not just the vulnerable process. Teams should first isolate without prematurely destroying volatile evidence, preserve disk, memory, configuration, authentication, firewall, proxy, and SIEM records, and then inventory anything the appliance could store, decrypt, relay, or issue. Confirmed—or operationally presumed—compromise warrants rotation of appliance administration and automation credentials, stored API keys, directory-bind or RADIUS secrets, service-account material, and relevant TLS or client-certificate private keys. Cisco’s warning that upgrading can destroy forensic logs makes sequencing especially important.
The other two risk lanes now have firmer limits. DarkSword is supported as an iOS 18.4–18.6.2 exploit chain reaching kernel-level access, with Coruna associated with cryptocurrency theft and intelligence collection. Exact victim counts, persistence, a Coruna-only version range, and firm attribution remain unverified; reported countries are observation points, not targeting boundaries, so enterprise priority should follow potential consequence rather than nationality. For the French refrigeration incidents, missing or untrustworthy temperature history is itself a quarantine trigger. Product-specific limits matter, temperature recovery does not prove safety, and inability to segregate inventory, monitor cases independently, or maintain traceability can justify department or store closure.
The remaining pressure point is whether Cisco’s unauthenticated root-capable path should displace Ivanti at the top. We turn next to that challenge because the ranking must survive exploitability, evidence integrity, and recovery consequences—not merely patch availability.