decrypted · 4 november 2026 · vulnerabilities and patching · supply chain · ai and llm security

Ivanti's patched gateways were still being taken over, and nothing showed on the box

A remote access gateway that was fully patched could still be taken over from the internet. That is the lesson of the Ivanti Connect Secure attacks, where one group chained three flaws, two of them zero-days: flaws attackers use before a fix exists. Ivanti shipped the last fixes on 29 October. The security firm Volexity assesses, with low confidence, that the group is criminal rather than a spy agency. For any UK organisation that lets staff in through a VPN, the question is no longer whether you patched. It is whether you would know.

How the chain worked

Picture a receptionist who checks your name against the visitor list, then lets a note in your hand decide which floor you walk to. Volexity found the login page worked that way. A request was checked against the access rules, but a header the attacker supplied decided where it actually went. That was the authentication bypass, CVE-2026-104935, CVE being the public reference number every known flaw gets.

Next, the attacker uploaded a script disguised as a zip file. The appliance wrote it to disk before checking the file type, and parallel requests won the race to run it. A privilege escalation, CVE-2026-111357, then gave root, the highest level of control. Ivanti shipped the first fix on 13 October and the rest followed. Fixed releases are 25.1.1.3 and 22.8R2.6, so anyone on 25.1.1.2 or 22.8R2.5 must upgrade again.

What the defender saw

There was no malware and no web shell to find. Volexity says the attacker replayed the whole chain for every command, deleted log entries and restored the settings it had changed. Ivanti's Integrity Checker Tool did not detect the compromise, because the attacker's patch to the appliance lived only in memory.

Once inside, the group went after Active Directory, the system holding staff logins. It searched for administrator passwords and disk recovery keys. Volexity also assesses, with medium confidence, that the attacker used large language models, the AI behind chatbots, for exploit development. The NCSC's chief executive warned this week that old flaws can now be exploited at a scale once unimaginable.

The Secure by Design lesson

A gateway that faces the internet, holds directory credentials and runs as root is a single point of failure by construction. Secure by Design asks whether it has to be. The cheap answers are old ones: put the appliance in its own network zone, give its service account the narrowest rights the job allows, and ship logs to a separate system, because an attacker who can delete local logs has erased your evidence.

Then ask the procurement question. BleepingComputer counts 38 Ivanti flaws on CISA's exploited list since November 2021, twelve also used in ransomware. That is a supplier track record a director can weigh.

Upgrade, then hunt: Volexity suggests checking for bursts of requests to the login page. If anything looks wrong, treat every credential the appliance held as stolen. Opinion, not advice.

Also this week

A security tool's update channel became the attack. The vendor behind cPGuard, a web server security suite, says that on 2 November an attacker used compromised credentials to push a malicious script through its update channel to versions 5.88.12 to 5.88.19. The script collected password files, database configuration, shell history and SSH files (SSH being the encrypted way administrators log in to servers), and opened a backdoor. The vendor says it spotted the problem within 12 hours and asks customers to update to 5.88.25 or later, then rotate passwords, database credentials and keys. It also suggests checking the install log for a "Successfully updated" entry: a hit shows installation, not that data left, and a missing log does not prove safety. The vendor's preliminary count is 32 collected files, one per customer server; BleepingComputer reports a spokesperson giving 2,946 servers affected. The two figures disagree, so treat both as provisional. The Secure by Design point: software that runs as root on your servers needs signed updates and a distribution system that one stolen login cannot reach.

Stolen AI keys are now a cash crop. Google's threat intelligence group says attackers are hijacking cloud credentials and API keys, the secrets one program uses to talk to another, to resell access to large language models. The dominant way in was exposed or stolen cloud identity tokens, not clever AI tricks. Some victims faced more than $100,000 of fraudulent charges in a day, and about $1 million cumulatively before access was revoked. One reseller advertises unlimited plans for around $60 a month, and Google expects actors to favour this over cryptojacking. Its advice is plain: scope keys narrowly, set spending caps and watch for unexpected enabling of AI services. Budget alerts are a security control now.

Sources