Volexity reports Ivanti flaws exploited in the wild

On 2 November 2026, SANS ISC details several security developments discussed in this edition of Stormcast. Didier’s OneNote attachment extractor has gained a new feature that saves all attachments from OneNote files into a JSON-formatted file, enabling batch processing across multiple files and improving data extraction efficiency.

Separately, a malicious Anthropic Claude Code extension was briefly available in the Cursor Visual Studio Code extension marketplace; Cursor subsequently shut the marketplace to assist cleanup. The malicious extension set up an SSH tunnel to enable further compromise of affected systems, and Cursor provides guidance on identifying whether a system is running the injected version or whether it was impacted by the SSH tunnel.

Ivanti’s Connect Secure advisory, initially published on 13 October, was expanded to cover two additional vulnerabilities with similar critical impact. The first was another missing authentication flaw for a critical function; the second involved predictable file names that facilitated the exploit chain. Volexity published a blog post describing how all three issues were observed exploited in the wild, which influenced the decision to update disclosures promptly.

In Android news, a working proof of concept for the “SMS of death” vulnerability—patched mid-October—demonstrates that a malformed WAP push SMS can crash com.android.phone and drop active calls without user interaction, constituting a denial-of-service effect.

Finally, regarding multi-path TCP, Linux kernels have implemented patches across several distributions. The vulnerability is exploitable where multi-path TCP is enabled and a TCP socket is listening; disabling the setting via sysctl can mitigate exposure until patches are applied.