AI-generated content. This briefing is compiled by an AI assistant from public sources. Summaries may contain errors — always verify details in the linked primary sources before acting.
IT & OT — stories from SecurityWeek, BleepingComputer, The Hacker News, Industrial Cyber + advisory watch: CISA, BSI, Ofgem
Two zero-days in two exploited zero-days in widely deployed security products dominate today’s briefing. Ivanti Connect Secure is under active exploitation by a previously unknown actor (UTA0576) who chained three flaws into unauthenticated root access on fully patched VPN appliances — one of the three flaws is still unpatched, and the actor deliberately evaded Ivanti’s integrity checks. Microsoft Defender, meanwhile, is back in the zero-day headlines: the “Nightmare Eclipse” researcher released a new “ShieldCrash” exploit claiming SYSTEM-privileged file access even after the September fix, amid a running bounty dispute. Patch Tuesday itself landed 1,411 fixes including 3 zero-days, so the weekly patch cycle is unusually loaded. Away from widely deployed products, Meta confirmed attackers stole code and personal data of ~1,500 people via a GitHub breach, a supply-chain story worth watching. In OT, CISA and the FBI published a fact sheet warning critical-infrastructure operators about third-party ICS integrators — the same risk pattern that made last week’s supermarket refrigeration attack possible. BSI published no new high-severity advisories overnight; yesterday’s SIMATIC S7 PLC advisory remains the one to check. Ofgem: still nothing new.
Actor UTA0576 has exploited three chained zero-days in Ivanti Connect Secure since October 3, achieving unauthenticated root-level code execution on a fully patched appliance (22.8R2.4). Ivanti patched two of the flaws (auth bypass + RCE) as CVE-2026-104935 on October 13 in versions 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1; the third — a privilege escalation flaw — is still unpatched. Unusually, the attacker deployed no malware or web shell, re-exploiting the device for every command and tampering with logs to evade the Integrity Checker Tool. Volexity found stolen credentials and password-spraying activity on the compromised device. Over 5,500 ICS instances are internet-exposed per Shadowserver. CISA has flagged 36 Ivanti vulnerabilities as exploited in the wild since 2021 — this vendor keeps being the entry point.
Takeaway: If if you run Connect Secure or any Ivanti edge appliance, patch today to the fixed builds, run the Integrity Checker Tool — but don’t trust it, since logs can be tampered — and hunt for anomalies in VPN appliance logs back to October 1.
Sources: SecurityWeek · BleepingComputer · The Hacker News · Primary source: Ivanti advisory · Primary source: Volexity analysis
Anonymous researcher group Nightmare Eclipse published “ShieldCrash”, a new zero-day exploiting Microsoft Defender on all supported Windows versions, claiming arbitrary file read as SYSTEM on fully patched systems (September 2026 updates). It’s the third in a chain: ShieldBreak (August) bypassed RoguePlanet (June, CVE-2026-50656); ShieldCrash targets Defender’s remediation pipeline using chained NTFS mount-point redirection. One analysis (Cyderes) found the published PoC’s claimed privilege escalation not fully functional — so treat as claimed, not confirmed. It’s part of an ongoing dispute with Microsoft over bug bounty and disclosure practices. This lands alongside October Patch Tuesday, which fixed 1,411 flaws including 3 zero-days.
Takeaway: If you run Defender for Endpoint fleet-wide. Even as a PoC, it means local SYSTEM attackers can read sensitive files via Defender — mitigation is standard privilege hygiene; watch for a Microsoft fix and keep Patch Tuesday deployment on schedule.
Sources: BleepingComputer · SecurityWeek · Patch Tuesday details · Primary source: Microsoft security updates · Independent test: Cyderes analysis
Meta disclosed that hackers obtained internal code and personal data of around 1,500 people, mostly US employees, in a breach of a GitHub organization. Affected individuals are being offered credit monitoring. The scale is modest for Meta, but the pattern — source-code theft via a developer-platform foothold — is the classic supply-chain prelude.
Takeaway: GitHub organization hygiene (member access reviews, PAT scoping, org-level audit logs) is the relevant control; ask whether your code repos’ access lists have been reviewed recently.
Sources: SecurityWeek · Primary source: Meta statement
CISA and the FBI published a joint fact sheet, “Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators”, urging operators to treat integrator access — design, installation, operational support, remote maintenance — as a first-class supply-chain risk. Recommendations center on least privilege, controlled remote access, network monitoring of integrator sessions, and contractual security requirements. The warning follows last week’s European supermarket refrigeration attack, which reportedly entered through the remote-management path of building/facility controllers.
Takeaway: Directly applicable to any OT estate: inventory which integrators hold remote access to PLC/SCADA environments and enforce per-session monitoring and just-in-time credentials.
Sources: SecurityWeek · Industrial Cyber · Primary source: CISA fact sheet
The FBI arrested an OpenAI engineer (a Saudi national, terminated Friday) after a hidden listening device was found in a conference room — a reminder that physical security and insider threat are part of cyber risk, especially at AI labs holding sensitive research. Low direct relevance to us, but useful as a board-level talking point on insider risk programs.
Takeaway: Insider-threat reviews should include physical space monitoring, not just digital exfiltration.
Sources: SecurityWeek · BleepingComputer · Primary source: FBI / OpenAI statements
Disclaimer: This briefing is compiled by an AI assistant. All summaries are AI-generated from public sources; links to the original articles and advisories are provided for verification. Always confirm details in the primary sources before acting.