Daily Cyber Threat Brief — October 14, 2026: Ivanti Zero-Day Chain Gave Attackers Root on Fully Patched VPNs

Volexity's investigation began October 5, after suspicious activity at a customer site led to an ICS appliance on version 22.8R2.4 — the latest release at the time. The chain, as described by Volexity and Ivanti: an authentication bypass affecting request routing, then a file-write race condition in an upload handler that allowed code execution as the appliance's cgi-server user, then a privilege-escalation flaw that raised access to root. The first two flaws are tracked together as CVE-2026-104935; the privilege-escalation flaw has no CVE in public reporting yet and remains unpatched. Affected releases per Ivanti: Connect Secure 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier.

What makes this chain operationally dangerous is its anti-forensics. The actor deployed no malware and no web shell, sent commands and retrieved results through the exploit channel itself, modified and then restored in-memory system state, and removed entries from Ivanti debug and Linux audit logs. Ivanti's Integrity Checker Tool verifies the filesystem; this attack lived in memory, so the checker can miss it. CISA's guidance: treat suspected compromise as a recovery case — back up the configuration, factory-reset and upgrade (rebuild virtual/cloud instances), then restore the configuration — and hunt with network and memory forensics. Ivanti says it is aware of "limited exploitation in the wild," but the exposed population is large: Shadowserver tracks over 5,500 ICS instances online, and Shodan shows roughly 35,800 hosts presenting an Ivanti-branded page. Ivanti has a long zero-day history in this product family: CVE-2023-46805 and CVE-2024-21887 in January 2024, CVE-2024-21893 two weeks later, CVE-2025-0282 in January 2025, and CVE-2025-22457 exploited by China-linked actors from mid-March 2025. CISA has flagged 36 Ivanti vulnerabilities as actively exploited since November 2021, 12 of them also abused by ransomware gangs.

TFG London is the UK arm of South Africa's The Foschini Group. The October 11 attack hit IT systems used by three premium fashion brands — Phase Eight, Hobbs, and Whistles — while the group's other brands, Inside Story and White Stuff, and its operations in Australia and Africa were unaffected. The group operates 649 retail locations globally with annual sales of £488 million ($646M). Several IT systems remained unavailable at disclosure on October 13, but physical stores stayed open. The company activated incident response and business continuity plans and brought in external cybersecurity experts. It says there is "no reason to believe that payment information is at risk," because card payments for its UK brands are processed by an external provider. No threat actor has publicly claimed the incident, and no attack vector has been disclosed. The incident follows an ASOS breach in which attackers used social engineering to steal an employee's login credentials and access customer names, contact details, and account information. Separately, rumors of an attack on H&M claimed by someone saying they were with the ShinyHunters group drew a denial: H&M told BleepingComputer it had found no indications its data environment was compromised.

Microsoft's October 13, 2026 Patch Tuesday is the largest it has ever shipped: 1,411 vulnerabilities by BleepingComputer's count (which counts only fixes released on Patch Tuesday itself; a further 348 flaws in Azure services, Exchange Server, and other products were fixed earlier in the month), including 70 rated Critical — 57 remote code execution, 11 elevation of privilege, and 2 spoofing. By category: 677 elevation-of-privilege, 317 remote code execution, 254 information disclosure, 73 denial-of-service, 40 security feature bypass, and 28 spoofing flaws. The batch dwarfs September's record of nearly 1,000 fixes. Three zero-days demand immediate attention. The actively exploited one, CVE-2026-96951 (CVSS 8.8), is a command-injection flaw in Windows Shell that lets an attacker bypass the Mark of the Web security feature — the label Windows applies to downloaded files so Office and SmartScreen treat them with suspicion. CISA added it to the KEV catalog with a federal patch deadline of October 16. Microsoft has shared no details on how it was exploited or who disclosed it. The two publicly disclosed zero-days: CVE-2026-108398, a .NET Framework flaw found by Google Project Zero's James Forshaw that can bypass Windows Defender Application Control, and CVE-2026-92707, a denial-of-service flaw in the MessagePack-CSharp library. Microsoft also introduced "risk cohorts" — 15 provisional vulnerability groupings with shared assessment questions, the largest covering Windows filesystems, storage, and backup with 136 vulnerabilities — to help teams triage at this volume. Microsoft says it is increasingly using AI tools to find and fix bugs, which may partly explain the record count.

IDC Frontier, a SoftBank-owned data center and cloud company, confirmed a ransomware attack took down part of its IDCF Cloud from about 03:40 on October 7, 2026, hitting four zones (tesla, henry, pascal, joule) of East Japan Region 1 at a data center in Shirakawa, Fukushima. A total of 495 companies and local governments were affected; websites of Ibaraki Prefecture and the Ibaraki Prefectural Police went down, per SoftBank as reported by Kyodo News. In its third report on October 8, the company said customer data in the four zones was unlikely to be retrievable or restorable. Its fifth report on October 14 reversed part of that: snapshot backups survived, and data can be retrieved for the 194 affected customers who used IDCF Cloud's snapshot function. The other 301 still depend on their own backups. The fifth report also says IDC Frontier found no trace that data in customers' virtual servers was viewed or taken out, and judges no data leaked. Separately, the account details of 48 customers in the IDCF Cloud Portal — including login IDs and password hashes — were improperly viewed. No unauthorized access has been found in IDCF Cloud's other zones and regions, but the management console remains suspended everywhere, and customers there are being asked to back up their own data. The company has not said how the attackers got in or who they are, and has reported the attack to its supervisory ministry and the Tokyo Metropolitan Police Department. The attackers' unverified claims — 225 databases encrypted, 3.6 PB of data, 239 hypervisors reached — remain unconfirmed by IDC Frontier.

Mobile security firm ThreatFabric reports a new Android malware, Hirudo, that steals bank credentials by replacing legitimate banking apps with modified copies that disable security checks. The malware is typically delivered via apps for shopping (Shopora), adult content (1V1 X), or short drama (ZoyaTV, KoiShort) that appear legitimate and deliver the promised functionality. Those apps act as loaders, showing a fake "update" notification that leads to permission-granting prompts, including for Accessibility services. Once installed, Hirudo launches the real banking app's uninstaller, downloads a patched copy, and abuses its Accessibility permission to install it. The malicious copy retains almost all of the original app's code but loads a hooking engine built on the open-source frameworks YAHFA and Dobby, which substitutes the genuine signing certificate when queried, hides enabled Accessibility services, and removes screenshot protection to allow remote viewing and recording. The malware can steal credentials, remotely control infected phones in real time, collect messages, capture screenshots, and record audio. ThreatFabric observed Hirudo impersonating at least seven Indonesian banks, and says it also targets financial organizations in China, India, Mexico, Morocco, and Thailand. The researchers note the replacement process is delicate — the victim can interrupt it at two points — which is one reason the fake-update social engineering matters as much as the code.