CYBER THREATCAST

Patch Ivanti Connect Secure against CVE-2026-104935 immediately, then investigate exposed appliances and rebuild them where compromise is suspected. Rotate passwords, certificates, API keys and license-server credentials associated with affected systems. UTA0576 has chained the authentication bypass with other flaws for unauthenticated root-level command execution, credential theft, Active Directory data access and exfiltration; attackers also manipulated logs, so clean integrity-check results should not end the investigation.

Deploy Microsoft’s October 2026 security updates, prioritizing CVE-2026-96951 on Windows systems. The actively exploited Windows Shell command-injection flaw requires a victim to open a crafted file delivered through channels such as email or messaging, and CISA added it to the Known Exploited Vulnerabilities catalog with an October 16, 2026 federal remediation deadline.

Review mobile-backend logs from August 2026 onward and inventory every API endpoint exposed through public Android and iOS applications. Enforce object-level authorization and access controls, add rate limiting, and test server-side interfaces for IDOR or BOLA, SQL injection, SSRF and remote code execution. NICT confirmed that attackers reverse-engineer published Android apps to recover endpoints, parameters, keys and undocumented functions, putting organizations with mobile application backends at risk.

Identify Danfoss AK-SC 355, AK-SM 800 and AK-SM 800A refrigeration controllers, update outdated firmware, and prioritize replacement of end-of-life units. Attackers exploited a firmware flaw to manipulate refrigeration systems at hundreds of French supermarkets, causing spoiled inventory, equipment damage, fires and losses estimated in the tens of millions of euros. Retailers and other operators using these controllers should treat remediation as an operational-safety priority, not a routine maintenance task.

Patch self-managed GitLab Community Edition and Enterprise Edition deployments for CVE-2026-97229 without waiting for confirmed attacks. Rapid7 reproduced unauthenticated code execution against an unpatched official GitLab CE image, and the CVSS 10.0 pipeline-processing flaw could expose source code and credentials or enable downstream build compromise. Prioritize internet-accessible instances and systems holding sensitive repositories or build secrets.