Ivanti Connect Secure Zero-Day CVE-2026-104935: Patch Now

The pattern from the last three weeks holds: the kit attackers go for first is whatever sits on the edge of a company network, the VPN, the firewall and the email gateway. This week it is Ivanti’s remote access gateway, attacked before a fix existed, plus an exploited Windows flaw in Microsoft’s October update and a Palo Alto firewall bug. The NCSC also named a Chinese company it says supplies hacking groups, and the data protection regulator told the Met Police off for using an unapproved app.

Ivanti Connect Secure was attacked before a fix existed

On 13 October Ivanti published an advisory for CVE-2026-104935 in Ivanti Connect Secure, the VPN many firms use to let staff work from home. It is an authentication bypass that lets an attacker with no login run commands on the appliance, and Ivanti says a limited number of customers were attacked before it disclosed the flaw. CISA added it to its exploited list the same day. Rapid7 reports that the forensics firm Volexity found the attackers in early October, and that they paired this bug with a second, privilege escalation flaw that Ivanti has not yet patched.

Affected versions are 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier; Ivanti says 22.7R2.14 and older are not affected. The fixes are 25.1.1.2, 25.1.3.0 and 22.8R2.5. Because the attack started before the patch, and part of the chain is still unpatched, updating is not the end of it: Rapid7 advises looking for signs of compromise even after the update. If an IT provider runs your VPN, ask which version it is on and whether they have checked it, not only whether it is patched. Under Cyber Essentials, critical fixes are due within 14 days; our patch deadline calculator works out the date. Sources: Rapid7, BleepingComputer and SecurityOnline, which lists the fixed builds.

Microsoft’s October update fixes a Windows flaw already in use

Microsoft’s October security update, released on 13 October, includes a fix for CVE-2026-96951, a command injection flaw in Windows Shell that Microsoft marks as exploited. An attacker who gets someone to open a booby-trapped file from an email or chat message can slip past Mark of the Web, the label Windows puts on downloaded files so that Office and SmartScreen treat them with suspicion. Microsoft scores it 8.8 out of 10, and the fix covers Windows 10, Windows 11 and Windows Server from 2012 R2 to 2025. CISA added it to its exploited list the same day.

This is a phishing flaw, so it lands on ordinary office PCs, not just servers. Check that the October update has installed on every laptop, including the ones that rarely get restarted. Mark of the Web is one of the quiet defences behind the advice in our guide to phishing attacks, and a working update process is one of the security controls insurers ask about. Details are in Microsoft’s Security Update Guide.

Palo Alto firewalls and Cisco email gateways: two more on the list

On 14 October Palo Alto Networks published CVE-2026-0322, a flaw in the management interface of PAN-OS firewalls and Panorama that lets an attacker who already has an admin login run code as root. It says it has seen “very limited exploitation”, and that the risk is highest where the management interface can be reached from the internet. Fixed versions include 12.2.4 and 11.2.16, with hotfix builds for older branches; Cloud NGFW and Prisma Access are not affected. CISA added it to its exploited list the same day, alongside CVE-2026-76519 in Cisco Secure Email Gateway, a bug that lets an attacker with no login write files to the system.

The Palo Alto bug needs a login, which makes it sound minor. It is not, if a weak or reused admin password is the only thing in the way. Its advice for every firewall is the same: keep the management page off the internet and reachable only from trusted internal addresses. Our guide to network security for small businesses covers the basics. Sources: Palo Alto Networks, Cisco and CISA’s catalogue.

The NCSC names a Chinese company it says arms hacking groups

On 8 October the NCSC and eight partner agencies from six countries published an advisory on Integrity Technology Group, a China-based company the UK sanctioned last year. The advisory says it enables China-linked actors who combine AI tools such as automated scanning with large botnets and hands-on hacking to break into networks and steal data, in campaigns also known as Flax Typhoon. It says the company’s staff develop tools, acquire and host infrastructure, and compromise networks around the world.

The practical point for a small firm is where these groups get in: internet-facing devices that have not been updated, which is why the three patches above matter. The NCSC urged all organisations to read the advisory and follow its mitigations. If you are not sure what your business exposes to the internet, a cyber security risk assessment is the place to start. The announcement is on the NCSC website.

The ICO reprimands the Met over an unapproved app

On 14 October the ICO said it had issued a reprimand and an enforcement notice to the Metropolitan Police Service. Its officers and staff had used a retail crime intelligence-sharing platform the force had never approved: about 500 accounts were created, 375 were actively used, and between January and September 2024 personal details of 179 people, three of them under 18, were uploaded to it. The ICO found no data protection impact assessment had been done before the high-risk processing began.

Swap “police force” for “small firm” and this is shadow IT: staff picking up a handy app that nobody checked. The ICO’s message is that new tools need a risk assessment and an approval process before personal data goes into them. Our pages on data processing agreements and UK GDPR set out what that involves. Read the ICO announcement.

Also this week

Complaints to the ICO about automated nuisance calls rose from 1,374 in July to 2,178 in August and 3,684 in September, the highest level since 2021, the regulator said on 9 October. It warned that many of these “robo calls” are used to trick people into sharing personal information or joining scam WhatsApp groups. Details are on the ICO website.