Verified status
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-111357 in Ivanti Connect Secure is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-30; federal remediation due 2026-11-02). NVD rates it 7 (HIGH) on CVSS v3.1. NVD lists a vendor advisory. (checked 2026-10-31)
- CVE-2026-118527 in Ivanti Connect Secure is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-30; federal remediation due 2026-11-13). It was not yet in the NVD; details came from the source articles. (checked 2026-11-01)
TL;DR
Ivanti Connect Secure vulnerabilities chained for unauthenticated root access; Chainalysis breached via AI-powered attack techniques; Android SMS-of-Death PoC released. Patch Ivanti systems immediately and rotate API credentials at third-party platforms.
Executive Summary
- CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. These flaws can be chained with a third vulnerability to achieve unauthenticated root access.
- Chainalysis disclosed a data breach exposing customer names, email addresses, user IDs, and organizational roles after attackers used “offensive agentic techniques” to compromise internal systems.
- A proof-of-concept exploit for a reported vulnerability (identifier could not be verified against NVD and has been withdrawn), an Android vulnerability dubbed “SMS of Death,” was released, enabling attackers to remotely crash phones or disrupt cellular service via specially crafted text messages.
- Northflank disclosed a security breach leading to unauthorized use of customers’ AI API keys, requiring immediate credential rotation.
- DDoS attack volume increased 38% in Q3 2026, with Cloudflare reporting 18.2 million network-layer attacks and 14.4 trillion HTTP requests mitigated.
Top Threats Today
1. Ivanti Connect Secure—Chained Vulnerabilities Enable Unauthenticated Root Access
Severity: HIGH Affected: Technology
Attackers are chaining three Ivanti Connect Secure vulnerabilities to gain unauthenticated root access to affected systems [1]. CISA added CVE-2026-111357 (missing authentication for critical function) and CVE-2026-118527 (predictable numbers/identifiers) to its Known Exploited Vulnerabilities catalog on October 30, 2026, following confirmation of active exploitation in the wild [1][3]. These two flaws can be chained with CVE-2026-104935 to escalate privileges and achieve full system compromise ⚠[2][3]. Federal remediation for CVE-2026-111357 is due November 2, 2026, and for CVE-2026-118527 by November 13, 2026 [2][3].
Sources:[1] The Hacker News[2] CISA KEV[3] CISA KEV
Recommended Action
- Inventory all Ivanti Connect Secure deployments and prioritize patching based on exposure level (internet-facing systems first)
- Apply vendor-supplied patches immediately; do not delay for change control windows
- Monitor authentication logs and system access for signs of compromise dating back 30 days
- Consider temporary segmentation or access restrictions if patching cannot be completed within 48 hours
2. Chainalysis Breached via AI-Powered Attack; Customer Identity Data Exposed
Severity: HIGH Affected: Finance
Chainalysis, an American blockchain analysis firm, disclosed a data breach in which an external actor accessed non-sensitive customer data, including customer names, email addresses, user IDs, and organizational roles [1][2]. The attackers used “offensive agentic techniques” to compromise internal tools and systems [2]. The company stated that the breach did not result in unauthorized access to investigation content or authentication credentials [1]. The incident underscores the emerging risk of AI-powered attack techniques targeting enterprise infrastructure. ⚠
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Chainalysis customers should monitor for phishing and social engineering targeting exposed email addresses and organizational roles
- Review API keys and authentication credentials for Chainalysis services and rotate if necessary
- Enable multi-factor authentication on all accounts that interface with Chainalysis platforms
3. Android “SMS of Death” Exploit Released; Unpatched Devices at Risk
Severity: HIGH Affected: Technology
A security researcher has released a proof-of-concept exploit for a reported vulnerability (identifier could not be verified against NVD and has been withdrawn), dubbed “SMS of Death,” that allows attackers to remotely disrupt cellular service or crash unpatched Android phones by sending a specially crafted text message [1]. The vulnerability was recently patched, but devices running older versions remain vulnerable to remote denial-of-service attacks via SMS.
Sources:[1] BleepingComputer
Recommended Action
- Advise users to apply the latest Android security updates immediately
- Implement device management policies requiring monthly security patch installation
- Monitor for unusual SMS-related crashes or service disruptions in organizational device fleets
4. Northflank Cloud Platform Breach Leads to AI API Key Abuse
Severity: HIGH Affected: Technology
Cloud application hosting platform Northflank disclosed a security breach that resulted in unauthorized use of customers’ AI API keys stored on its platform [1]. The company is warning all customers to rotate credentials and secrets immediately.
Sources:[1] BleepingComputer
Recommended Action
- Northflank users must immediately rotate all API keys, database credentials, and secrets stored on the platform
- Review API usage logs from the date of the breach onwards for unauthorized access patterns
- Re-issue authentication tokens and consider implementing IP-based access restrictions on sensitive APIs
- Migrate to alternative credential storage solutions (e.g., HashiCorp Vault, AWS Secrets Manager) with stricter access controls
5. DDoS Attacks Surge 38% in Q3; Cloudflare Reports Record Attack Volume
Severity: MEDIUM Affected: Technology
Threat actors are launching approximately 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, according to Cloudflare [1]. The web infrastructure and security company reported that it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in Q3 2026, representing a 38% increase from the prior quarter [1]. This surge indicates sustained and growing DDoS activity targeting web-facing infrastructure globally.
Sources:[1] The Hacker News
Recommended Action
- Ensure DDoS mitigation services (Cloudflare, Akamai, AWS Shield, etc.) are active on all internet-facing web applications
- Review and test DDoS response procedures, including failover and traffic rerouting capabilities
- Monitor for anomalous traffic patterns and configure alerts for sudden traffic spikes
Today’s Action Checklist
- ☐ URGENT: Patch all Ivanti Connect Secure systems for CVE-2026-111357 and CVE-2026-118527 within 48 hours
- ☐ URGENT: Rotate all API keys and credentials stored on Northflank; audit recent API usage for unauthorized access
- ☐ HIGH: Chainalysis customers: enable MFA and monitor for phishing targeting exposed email addresses
- ☐ HIGH: Deploy latest Android security patches to organizational mobile devices; monitor for SMS-triggered crashes
- ☐ STANDARD: Review DDoS mitigation configuration and test failover procedures