Ivanti flaws remain part of an exploited access chain

The Hacker News reported that the Ivanti Connect Secure exploit chain combines CVE-2026-111357, CVE-2026-118527 and the authentication bypass CVE-2026-104935.The Hacker News The outlet said the chain enabled unauthenticated root-level code execution; CISA had added the first two flaws to its Known Exploited Vulnerabilities catalogue on 30 October 2026.The Hacker News Ivanti released fixes for CVE-2026-111357 and CVE-2026-118527 in versions 25.1.1.3 and 22.8R2.6, respectively, with the fixes covering 25.1.1.2 and earlier, and 22.8R2.5 and earlier.The Hacker NewsSecurity Affairs Ivanti said a fix for CVE-2026-104935 had been developed and quality-assured for supported versions, with backporting underway for other releases when exploitation was detected.The Hacker News

AnalysisThe reporting describes CVE-2026-104935 as part of the same chain, while the two vulnerabilities CISA listed on 30 October are now covered by released fixes.The Hacker NewsSecurity Affairs

Coinspect said attackers still held valid TLS certificates for 13 domains redirected through Name.com, and that the certificates remain valid until 29 January 2027.cybersixt All 15 affected domains had been restored, but the attacker’s DNS zones for 13 remained on Name.com’s nameservers, Coinspect said at 18:24 UTC on 31 October.cybersixt Name.com acknowledged at 17:13 UTC on 31 October that a number of its domains had been improperly redirected late Friday as part of a plan to access visitors’ crypto wallets, and said it was investigating.cybersixt Coinspect traced changes to nameserver delegation for 14 domains between 00:35 and 01:20 UTC on Friday night; how the attackers obtained access to make the changes remains unknown.cybersixt

Northflank told customers to assume all environment variables had been decrypted and to rotate keys stored on its platform.cybersixt The company said users had reported unauthorised use of AI API keys supplied to the service, and turned on audit logs for all customers, including free accounts, at 01:04 UTC.cybersixt Northflank has not said how the environment variables were decrypted, whether they were copied, how many customers were affected or how long the exposure lasted.cybersixt Its status page listed networking, services, add-ons, jobs and builds as a major outage; the company said it had no further confirmed findings to share at 19:28 UTC on 30 October.cybersixt

AnalysisWiz counted Northflank among nine AI developer platforms that disclosed incidents in October, while Northflank has not confirmed the incident’s entry point or affected customer count.cybersixt