Ivanti VPN zero-days, exploited Windows flaw, Docker Hub token mix-up | Cyber Security News Oct 14

Attackers chained Ivanti Connect Secure zero-days to take over VPNs without a login, one of them fully patched, and Microsoft's record October updates fix a Windows flaw that skips the warning on downloaded files. Also: Fortinet, Chrome, Copilot in Visual Studio, SAP, npm trusted publishing, Ghostscript, and a Docker Hub flaw that handed old tokens to new owners. Every version number and every fix in this episode was checked against the vendor's advisory or the CVE record before it aired. Today's question: Which remote-access path into your network would you least like to explain to an auditor? Reply in the comments or at [email protected].

1. Ivanti VPN zero-days give root before login - CVE-2026-104935 - Fixed: 22.8R2.5, or 25.1.3.0 or later - federal due 2026-10-16 - Do: Upgrade Ivanti and rotate its directory account - https://www.cve.org/CVERecord?id=CVE-2026-104935

2. Exploited Windows flaw leads record Patch Tuesday - CVE-2026-96951, CVE-2026-70571, CVE-2026-70229 - federal due 2026-10-16 - Do: Push October's Windows updates - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951

3. FortiSandbox and FortiSIEM fix pre-login flaws - CVE-2026-107656, CVE-2026-106173 - Fixed: FortiSandbox 5.0.7 or 4.4.10; FortiSIEM 7.5.1 - Do: Upgrade FortiSandbox and FortiSIEM - https://fortiguard.fortinet.com/psirt/FG-IR-26-185

4. Chrome update fixes seven critical flaws - CVE-2026-110152, CVE-2026-110149, CVE-2026-110136 - Fixed: 155.0.8059.79/.80; Extended Stable 152.0.7977.167 - Do: Update Chrome and force the restart - http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html

5. Copilot in Visual Studio could run commands - CVE-2026-103572 - Fixed: 17.14.42 or 18.10.4 - Do: Update Visual Studio and SSMS - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103572

6. SAP fixes four critical flaws in October - CVE-2026-89111, CVE-2026-89110 - Fixed: sap-cloud-sdk 0.45.2 - Do: Apply SAP's October security notes - https://www.cve.org/CVERecord?id=CVE-2026-89111

7. Vendor-run gateway let an attacker into a bank - Do: Require MFA on vendor-managed remote access - https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/

8. npm trusted publishing trusted repository names - Do: Review your npm packages' trusted publisher settings - https://github.blog/changelog/2026-10-02-unvalidated-npm-trusted-publishing-configurations-now-expire

9. Ghostscript flaw reachable through uploaded PDFs - CVE-2026-39919 - Fixed: 10.08.0 - Do: Update Ghostscript on servers that process uploads - https://www.cve.org/CVERecord?id=CVE-2026-39919

10. Docker Hub handed old tokens to new owners - CVE-2026-105445 - Do: Revoke Docker Hub tokens you don't recognize - https://docker.com/blog/docker-hub-security-advisory-cve-2026-105445