decrypted · 14 october 2026 · vulnerabilities and patching · supply chain · surveillance and privacy

Ivanti Connect Secure: a zero-day chain that your integrity checker cannot see

A VPN gateway is meant to be the locked front door of an organisation. This week Volexity, a US threat intelligence firm, described how one attacker walked through that door on fully patched Ivanti Connect Secure appliances, left no malware behind, and slipped past the vendor's own integrity checker. Ivanti released a fix on 13 October for part of the chain. By Volexity's account, the final step is still unpatched.

How the chain worked

Think of a receptionist who checks your pass for the public lobby, then obeys a note in your hand saying "actually, take me to the server room". That is the first flaw: a request to a public login page could name a different, private script in a header, and the access check never looked at the header. Volexity says the second flaw abused a race. The upload handler saved a file before checking it was valid, and deleted it if not, so the attacker ran their script in the gap. Those two are tracked as CVE-2026-104935. The third step turned a foothold into full control, and Ivanti says a fix will come in a future release.

Volexity found no web shell and no backdoor. Each command simply re-ran the whole chain, with the payload held in memory only. The attacker then used the appliance's directory service account to look up local administrator passwords and disk recovery keys, captured credentials passing through the box, and edited logs on the way out. Volexity dates the first exploitation to 3 October, ten days before a patch existed.

What a defender sees

Very little. Volexity says Ivanti's Integrity Checker Tool does not detect this activity, because the changes sit in memory and the configuration is put back afterwards. What does show up:

Bursts of requests to the login page carrying an unusual routing header that does not match the URL.
Hidden directories and renamed packet-capture processes on the appliance.
Directory queries for administrator passwords and recovery keys from the VPN's own service account.

BleepingComputer notes that CISA lists 36 Ivanti flaws as known exploited, 12 of them used by ransomware groups.

The Secure by Design lesson

The deeper problem is architectural. An internet-facing appliance that terminates every remote session, holds a privileged directory account and cannot be independently inspected is a very large bet on one vendor's code. A tool that vouches for its own integrity, on a device the attacker already controls, is marking its own homework.

What this costs to apply is modest next to a breach:

Patch now, then assume nothing. If you ran an affected version since early October, commission memory and network forensics rather than relying on the checker.
Reset credentials the appliance could reach, including the directory service account.
Cut that account's privileges to the minimum. It should not be able to read administrator passwords or recovery keys.
Log from outside the device, so an attacker cannot edit the evidence.

Opinion, not advice: a board that still treats the remote access gateway as a plumbing detail is carrying a risk it has not priced.

Also this week

Supply chain: Docker Hub. Docker disclosed CVE-2026-105445, rated critical. When an account was converted into an organisation, its personal access tokens passed to the new owner without rotation or consent, so an attacker could name a victim as owner and keep a working token. Docker says it fixed the flaw within four hours of the 30 September report and found no evidence of exploitation after reviewing about 304,000 pushes. Logs only show tokens that were used, so an unused token leaves no trace. Review your own token lists and prefer organisation tokens for automation.

Breach: Housing Ombudsman. The Housing Ombudsman Service says a third-party IT incident hit its case management system on 13 October. Residents cannot submit or view complaints online, and the incident has been reported to the data regulator. The service says it is contained, and whether personal data was affected is still being checked. Tenants are advised to be wary of unsolicited messages. The supplier has not been named, which is the question every organisation should be able to answer about its own case systems.

Policy: Xandr fined. Norway's data protection authority fined Microsoft-owned Xandr NOK 92 million, its largest penalty, for passing Grindr users' data, including data revealing sexual orientation, into real-time ad auctions. The regulator said responsibility for data protection cannot be passed on to others. Grindr itself was fined NOK 65 million in 2021. Microsoft says the conduct predates its acquisition and that it is reviewing the decision. Anyone buying ad tech should verify consent rather than assume a partner obtained it.

Sources