01
Security
Ivanti warns of Connect Secure zero-day under active attack
The flaw can let unauthenticated attackers run commands on affected appliances, and fixed Connect Secure builds are now available.
The flaw can let unauthenticated attackers run commands on affected appliances, and fixed Connect Secure builds are now available.
Lumen says the campaign keeps adding victims even after it blocked traffic to known control servers.
More than 400 SMA1000 appliances are visible online, leaving exposed systems under active attack attempts.
The seizure cuts off infrastructure used to scan and break into targets, while a joint advisory gives defenders indicators and steps to check for compromise.
The issues affect Nexus switches when NX-API, NGOAM or MPLS OAM are enabled, so operators should treat them as urgent even with no workaround.
Attackers are deleting recovery copies before encryption, making restoration harder and raising the stakes for victims.
The updates close a high-severity NetScaler bug that attackers were already using, forcing affected agencies and users to move quickly.
MikroTik users exposing router management services need to treat this as a high-priority fix and keep those systems off the public internet.
CISA has added the bug to its exploited-vulnerability list, putting exposed FortiMail systems on a tight mitigation clock.
The fix closes a route to command execution in self-hosted AI Gateway setups, while GitLab-hosted customers were already protected.
US cloud services under FedRAMP face stricter scan cadence, fast-turn remediation and ongoing evidence-based oversight by early 2027.
A Red Heron–linked actor used fresh WordPress and ZyXEL bugs to raid government and small-business systems worldwide for credentials and personal data.
Federal agencies must rapidly patch and investigate Linux and Zyxel devices as exploits and public PoC code drive real‑world attacks.
US agencies inspected two U.S.-bound tankers after network breaches, as officials probe possible Iranian involvement.