TL;DR for CISOs: Ivanti Connect Secure was hit by a zero-day chain that reached root on a patched VPN with one flaw still unpatched, Meta said attackers used a stolen credential to take code and data on 1,500 people from GitHub, TFG London disclosed a cyberattack at three UK fashion brands, and Microsoft's record Patch Tuesday included one exploited Windows zero-day.
- A clean integrity scan is not evidence of a clean VPN. Plan for forensics on edge devices, and rotate the directory credentials stored on them.
- Source control is a data store and a credential target. Scan for secrets and personal data, and harden developer authentication.
- At record patch volume, prioritize by exploitation and exposure, and tell leadership where capacity is the limit.
Lead story: Ivanti Connect Secure zero-day chain gives attackers root on a patched VPN
CRITICAL · REMOTE ACCESS / EDGEFlaw: CVE-2026-104935 in Ivanti Connect Secure, an authentication bypass and remote code execution pair that Ivanti rates 8.6, per The Hacker News. Ivanti says it is aware of limited exploitation
Chain: Volexity reports three zero-days chained for unauthenticated root-level code execution. Two are patched. The third, a privilege escalation flaw, is unpatched, and Ivanti expects a fix in the coming weeks
Timeline: Volexity dates exploitation to at least October 3. BleepingComputer reports Defused saw first signs on October 1. Ivanti disclosed on October 13
Victim: Volexity found the activity on one customer appliance that was fully patched and running 22.8R2.4
Attacker activity: Volexity tracks the actor as UTA0576. It reports stolen stored credentials including LDAP domain credentials, Active Directory queries, searches for LAPS passwords and BitLocker recovery keys, and password spraying. No backdoor or web shell was found, and the exploit evaded Ivanti's Integrity Checker Tool
Fixed builds: SecurityWeek lists 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. BleepingComputer lists affected builds as 22.8R2.4 and earlier, 25.1.2.2 and earlier and 25.1.1.1 and earlier. The sources do not fully reconcile, so check your build against Ivanti's advisory
Exposure: Shadowserver tracks more than 5,500 internet-exposed Connect Secure instances, per BleepingComputer. How many are already compromised is not known
Assessment: Volexity assesses with low confidence that the actor is criminal rather than espionage-driven, and with medium confidence that it uses large language models in exploit development, per SecurityWeek
Not confirmed: Number of victims, attacker identity, the CVE for the privilege escalation flaw, and whether upgrading removes access an attacker already holds
What happened
Ivanti disclosed the flaw on October 13 and told customers on affected versions to upgrade. The notable detail is how the attacker used it. Volexity says the actor re-ran the whole exploit chain for each command, changed library code only in memory and restored configuration data afterward. That left no persistent file for a scanner to find.
Volexity says it disrupted the operation and assesses with high confidence that the activity was preparation for lateral movement. Credential theft from the appliance is the point to watch, because a VPN gateway holds the directory credentials that connect it to everything behind it.
Evidence
Verified against independently fetched sources:
1. BleepingComputer, Ivanti warns of Connect Secure zero-day exploited in attacks
2. The Hacker News, Attacker chains three Ivanti Connect Secure zero-days for root access
3. SecurityWeek, Ivanti zero-day chain gave attackers root access to fully patched VPN
What this means for your team
A patched and integrity-checked appliance is not proof of a clean appliance. Volexity says the Integrity Checker Tool missed this chain, so a clean scan result should not close an incident review. Confirming compromise reportedly requires network and memory forensics.
The open privilege escalation flaw means there is a window where a fix exists for part of the chain only. Treat the appliance as exposed until Ivanti ships the remaining patch, and assume the credentials stored on it are the first target.
The longer pattern matters for planning. BleepingComputer cites CISA as listing 36 Ivanti vulnerabilities as exploited since November 2021. If remote access sits on one vendor's gateway, your resilience plan should assume repeat events.
Action checklist
- Inventory every Connect Secure appliance, including those run by acquired companies and contractors, and record each build number against Ivanti's advisory.
- Upgrade to a fixed build now, then hunt for the indicators Volexity published: heavy requests to /dana-na/auth/url_default/welcome.cgi, an X-DSCGI-PATH header that does not match the URL, and a /data/.icscap/ directory.
- Rotate service and LDAP credentials stored on or reachable from the appliance, and review Active Directory logs for password spraying and LAPS or BitLocker key lookups from the appliance's address.
- Restrict management and portal exposure where you can, and set a reminder to apply the third patch the day Ivanti releases it.
Meta says attackers took code and data on 1,500 people from GitHub repositories
HIGH · DEVELOPER PLATFORM / CREDENTIALSWhat Meta said: An outside group accessed some of its GitHub repositories using a stolen employee credential. Meta says this was not a vulnerability in a Meta product and that its internal systems were not breached
Data taken: Meta says about 99 percent was business data, mainly code tied to some products, and about 1 percent was personal data. Meta has not said what types of personal data were involved
People affected: About 1,500 individuals, mostly U.S.-based Meta employees. Meta is offering credit and dark web monitoring and is notifying regulators
Why personal data was there: Meta says personal data was placed in the repositories by mistake, against company policy, and that much of it was synthetic or anonymized test data
Response: Access was shut down with GitHub and law enforcement involved, secrets in the affected repositories were rotated, and Meta says it added scanning to catch user data uploaded by mistake
Attribution: Meta says its work with GitHub so far does not indicate the attackers specifically targeted its data. No actor has been named
Not confirmed: How the credential was stolen, whether the code was altered or published, and what the personal data fields were. The second outlet reviewed republishes Meta's statement to SecurityWeek, so this is one primary disclosure
What happened
Meta detected the intrusion a few weeks before disclosure and began notifying affected people on October 13, per SecurityWeek. The account describes a credential-theft path, not a software flaw.
The personal data is the part with the clearest lesson. It reached a code repository against policy, which is how test fixtures, exports and debug files usually end up in source control.
Evidence
Verified against independently fetched sources:
1. SecurityWeek, Meta says hackers took code, personal data of 1,500 in GitHub breach
2. Cyber Security News, Hackers breach Meta GitHub repositories (relays Meta's statement to SecurityWeek)
What this means for your team
Repositories are a data store whether or not anyone intended them to be. If a company of Meta's size had personal data in source control despite a policy, a policy alone is unlikely to be enough in your environment either.
A single stolen employee credential was enough to reach code. That points to the controls around developer identity: phishing-resistant authentication, session lifetime and what a developer token can read.
Action checklist
- Run secret and personal-data scanning across all repositories, including archived and forked ones, and treat findings as incidents, not tickets.
- Require phishing-resistant authentication and short-lived tokens for source control, and review which developer accounts can read every repository.
- Review how test data is produced. Synthetic data that is hard to tell from real data is a risk for defenders and attackers alike, so label it.
- Check your notification obligations for employee data held in engineering systems, which privacy teams often miss.
TFG London cyberattack disrupts Phase Eight, Hobbs and Whistles
HIGH · RETAIL / OPERATIONSWhat the company said: TFG London, the UK arm of South Africa's The Foschini Group, reported a cyber incident that disrupted IT systems at Phase Eight, Hobbs and Whistles. Stores remain open
Timeline: Detected Sunday, October 11. Disclosed to investors on Tuesday, October 13 through the Johannesburg Stock Exchange news service, per The Record
Not affected, per the company: Inside Story, White Stuff, and operations in South Africa and Australia, which use separate IT systems. BleepingComputer also lists Africa operations as unaffected
Customer guidance: Avoid duplicate orders, stay alert to phishing, and no password change is needed at this stage. The company says payments run through an external provider and it has no reason to believe payment data is at risk
Response: Incident response and business continuity plans were activated, external specialists are engaged, and UK authorities were notified
Not confirmed: Attacker identity, entry method, whether any customer data was accessed, and the restoration timeline. BleepingComputer found no claim of responsibility
Context: BleepingComputer mentions separate recent retail incidents, including an ASOS breach tied to social engineering. No link to this event is reported
What happened
The disruption sits inside one subsidiary, and the company separated it from sister brands and other regions. That separation is the practical story: shared parent, separate IT estates, and a contained blast radius.
The sources differ slightly on timing and scope detail, and neither confirms data loss. Treat any data-theft claim as unverified until the company or a regulator says so.
Evidence
Verified against independently fetched sources:
1. BleepingComputer, TFG London cyberattack disrupts systems at Hobbs and Whistles retailers
2. The Record, Foschini Group investigating cyberattack on British fashion brands
What this means for your team
Retail is carrying a run of incidents, with Ahold Delhaize on October 12 and now TFG London. The common question for a board is not who the attacker is but how long the business can trade with reduced systems.
Subsidiary segmentation is the control that helped here. If an acquired brand shares identity, email or ordering with the parent, a single incident can stop several businesses at once.
Action checklist
- Map which subsidiaries and brands share identity, email and order systems, and document the isolation steps for each.
- Prepare customer messages ahead of time that cover duplicate orders, phishing warnings and password guidance, so they match legal advice from the first hour.
- Confirm your payment provider's incident notification terms and who calls them.
- Brief stores and call centers on the interim manual process before they need it.
Microsoft October Patch Tuesday: record volume and one exploited Windows zero-day
HIGH · ENDPOINT / VULNERABILITY MANAGEMENTVolume: BleepingComputer counts 1,411 flaws and SecurityWeek counts 1,413. BleepingComputer notes its figure excludes 348 flaws fixed earlier in October, and 70 are rated Critical. Counts differ by method
Exploited zero-day: CVE-2026-96951, a Windows Shell security feature bypass that evades Mark of the Web protection. SecurityWeek rates it CVSS 8.8 and says an attacker must get a user to open a crafted file. Microsoft has not shared how it was exploited
CISA: SecurityWeek reports it was added to the Known Exploited Vulnerabilities catalog with an October 16 federal remediation date
Publicly disclosed: CVE-2026-108398, a .NET Framework bypass of Windows Defender Application Control found by James Forshaw of Google Project Zero, and CVE-2026-92707, a MessagePack-CSharp denial of service. Neither is reported as exploited
Context: SecurityWeek attributes the surge largely to AI-driven vulnerability discovery and says Microsoft patched more this month than in all of 2025
Not confirmed: Who is exploiting CVE-2026-96951 and at what scale. The two sources also describe the exploit conditions differently
What happened
The exploited flaw weakens a warning that many email and download controls rely on. A file that arrives from the internet normally carries a mark that triggers protections, and this bypass removes the mark's effect.
The headline is the count. Microsoft's monthly release is now larger than many teams' entire quarterly patch capacity.
Evidence
Verified against independently fetched sources:
1. BleepingComputer, Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
2. SecurityWeek, Microsoft patches record 1,413 vulnerabilities, including exploited Windows zero-day
What this means for your team
Volume that high breaks patch-everything-by-severity. Prioritization has to start from what is exploited, what is internet-facing and what protects crown-jewel systems, and the remainder on a defined schedule.
Mark of the Web bypasses are most dangerous where email, chat and downloads are the main intrusion route, which describes nearly every enterprise.
Action checklist
- Deploy the fix for CVE-2026-96951 on an accelerated ring and meet CISA's October 16 date if you are a federal agency or supplier.
- Confirm that email and web gateways do not depend on the Mark of the Web alone to block risky files, and add detections for archive and shortcut delivery.
- Tell your vulnerability management owner how many of this month's CVEs apply to your estate, and agree a documented cutoff for the rest.
- If your capacity is the constraint, report that gap to leadership as a risk with a number.
Also notable
- Docker Hub: CVE-2026-105445 (CVSS 4.0 score 9.4 per the CVE record) let converting a personal account into an organization transfer its personal access tokens to the named owner. Docker says it fixed it on September 30 and found no evidence of exploitation after reviewing about 304,000 pushes. Review tokens and activity logs. Source: The Hacker News and BleepingComputer.
- SAP: CVE-2026-89111 (CVSS 10.0 per The Hacker News) in the SAP Cloud SDK for Python could send OAuth2 client credentials to an attacker-controlled server in multi-tenant applications. No exploitation is reported. SAP's interim step is to validate tenant subdomains against registered tenants. Source: BleepingComputer and The Hacker News.
- UK Housing Ombudsman Service: investigating a third-party IT incident that affected its case management system, with new complaints on hold. It says the incident is contained and the ICO is notified. Data impact is not yet known. Source: BleepingComputer (single source reviewed).
- GitHub npm: Help Net Security and The Hacker News headlines report that a trusted publishing flaw exposed more than 1,500 npm packages to takeover. Details were not independently reviewed. Source: Help Net Security (headline-level).
Frequently asked questions
What is the Ivanti Connect Secure zero-day chain?
Volexity reports three Connect Secure flaws chained for unauthenticated root-level code execution, including on a fully patched appliance. Two flaws are patched, tracked together as CVE-2026-104935, and a privilege escalation flaw is still awaiting a fix. Ivanti says exploitation is limited.
What did Meta say was stolen from GitHub?
Meta says about 99 percent of the data was business data, mainly code, and about 1 percent was personal data on roughly 1,500 people, mostly U.S. employees. It says the access used a stolen employee credential and was not due to a product vulnerability.
Is customer data affected in the TFG London incident?
The company has not confirmed any customer data exposure. It says payments run through an external provider and it has no reason to believe payment data is at risk. Investigation is ongoing.
Which Windows flaw is exploited this month?
CVE-2026-96951, a Windows Shell security feature bypass affecting Mark of the Web protection. Microsoft has not said how it was exploited, and SecurityWeek reports CISA added it to the Known Exploited Vulnerabilities catalog.
What should a CISO do first this week?
Confirm Ivanti Connect Secure builds and hunt for the published indicators, rotate credentials stored on the appliance, accelerate the Windows Shell fix, and scan repositories for secrets and personal data.
Curated by Pritha Aash, Community Head, CISO Platform
Subscribe to the weekly newsletter
More from the Breach Intelligence hub, including our look at the Ahold Delhaize incident and the SonicWall SMA1000 flaw under attack, plus vulnerability management and third-party risk coverage on CISO Platform.
Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.
Comments