1. Top Action Item

Patch Ivanti Connect Secure now. CISA added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog after active exploitation, and attackers are chaining three flaws—including CVE-2026-111357, a missing-authentication issue rated CVSS 8.8—to gain unauthenticated root access. Organizations running Ivanti Connect Secure should apply Ivanti’s remediation immediately and review the source for the second KEV CVE and affected versions.

2. Exploited This Week

Ivanti Connect Secure — CVE-2026-111357 and related ICS flaws

• Source: The Hacker News
• Link: The Hacker News
• Severity: CVSS 8.8 for CVE-2026-111357; see source for related flaws
• What's happening: CISA added two Ivanti Connect Secure flaws to KEV after active exploitation, and attackers are chaining three flaws to gain unauthenticated root access.
• Fix: Apply Ivanti’s fixed ICS release and review the source for affected versions and the second KEV CVE.

Cisco SD-WAN Catalyst Controller — CVE-2026-20127

• Source: Cisco Talos
• Link: Cisco Talos
• Severity: see source
• What's happening: UAT-11473 exploited an authentication bypass in Cisco SD-WAN Catalyst Controller instances to gain unauthorized access and deploy KeyDrift.
• Fix: Patch affected Cisco SD-WAN Catalyst Controller instances per Cisco’s advisory; see source.

Drupal Commerce Core — CVE-2026-118539

• Source: The Hacker News
• Link: The Hacker News
• Severity: “Highly critical”; CVSS N/A
• What's happening: Drupal warns that threat actors are actively exploiting CVE-2026-118539, a missing-authorization flaw in Commerce Core.
• Fix: Apply Drupal’s Commerce Core security update for affected 0.0.0–2.41 and 3.0.0–3.3.13 installs; see source for the fixed release.

3. Critical Patch Roundup

WordPress Core — no CVE assigned

• Source: The Hacker News
• Link: The Hacker News
• Severity: High — CVSS 8.1
• What's happening: A remote-code-execution flaw in WordPress Core 4.7 through 7.1.3 drew nearly 63,000 attack attempts within 24 hours of patches being released; no CVE identifier has been assigned.
• Fix: Update WordPress Core to the patched release; see source.

PHP — CVE-2026-109618, CVE-2026-109619

• Source: Palo Alto Unit 42
• Link: Palo Alto Unit 42
• Severity: Critical
• What's happening: Unit 42 reports critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.
• Fix: Apply the PHP updates or mitigations in the Unit 42 threat brief; see source.

Node.js (“Node2Shell”) — CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, and related

• Source: Fortinet FortiGuard
• Link: Fortinet FortiGuard
• Severity: CVSSv3 9.8 for the set; individual CVEs listed high/medium
• What's happening: Multiple Node.js flaws affect 26.x, 24.x, and 22.x, including a Brotli decoder out-of-bounds write that permits remote code execution (CVE-2026-111497).
• Fix: Update Node.js 26.x, 24.x, and 22.x to patched releases; see FortiGuard advisory.

4. Home / SOHO Impact

• If you run a WordPress site, update WordPress Core now; a remote-code-execution flaw affecting versions 4.7 through 7.1.3 drew almost 63,000 attack attempts in 24 hours.
• If you run an online store on Drupal Commerce, update immediately and check for unauthorized changes; CVE-2026-118539 is being actively exploited.
• If you manage a small web server or CMS, update PHP for CVE-2026-109618 and CVE-2026-109619, and update Node.js if you run 26.x, 24.x, or 22.x.
• Update TeamViewer to the latest version; a malicious remote computer can crash the viewer’s TeamViewer and, depending on the platform, may also run code.
• Update Microsoft Edge to the latest build; it includes this week’s Chromium browser fixes.

5. Enterprise Impact

• Treat Ivanti Connect Secure as an emergency: CISA KEV-listed flaws are being actively exploited and chained for unauthenticated root access; patch and hunt for compromise.
• Patch Cisco SD-WAN Catalyst Controller for CVE-2026-20127; UAT-11473 used the authentication bypass to deploy KeyDrift, so review SD-WAN management-plane exposure and logs.
• Patch Drupal Commerce Core immediately where e-commerce is exposed; CVE-2026-118539 is under active exploitation.
• Prioritize WordPress Core updates across internet-facing sites; mass exploitation attempts began within 24 hours of patches and no CVE has been assigned.
• Inventory PHP versions on web servers and CMS platforms and apply the critical PHP fixes for CVE-2026-109618 and CVE-2026-109619.
• Rebuild or redeploy Node.js applications on 26.x, 24.x, and 22.x after applying patched releases; FortiGuard rates the Node2Shell set CVSSv3 9.8.
• Update TeamViewer across remote-support fleets; the flaw lets a malicious or compromised host attack the viewer’s machine.
• Check developer endpoints for the trojanized Claude Code extension version 2.1.313 distributed through Cursor Marketplace; it attempted to install a persistent SSH backdoor.

6. What To Patch First

1. Ivanti Connect Secure — fixed release for CVE-2026-111357 and related flaws (exploited; CISA KEV; unauthenticated root).
2. Cisco SD-WAN Catalyst Controller — patch for CVE-2026-20127 (exploited by UAT-11473/KeyDrift).
3. Drupal Commerce Core — update affected 0.0.0–2.41 and 3.0.0–3.3.13 installs for CVE-2026-118539 (actively exploited).
4. Node.js — update 26.x/24.x/22.x for Node2Shell CVEs including CVE-2026-111497 (CVSS 9.8; RCE).
5. PHP — update for CVE-2026-109618 and CVE-2026-109619 (critical; widely deployed).
6. WordPress Core — update affected 4.7–7.1.3 installs for the unassigned RCE flaw (CVSS 8.1; mass exploitation attempts).
7. TeamViewer — update to the latest release (remote-session flaw; see source).
8. Microsoft Edge — latest Chromium update (browser CVEs; see source).

Sources

• Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access — https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html
• Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN — https://blog.talosintelligence.com/uat-11473-keydrift/
• Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw — https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html
• WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours — https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html
• Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) — https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/
• Node2Shell CVEs — https://fortiguard.fortinet.com/psirt/FG-IR-26-187
• TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them — https://thehackernews.com/2026/10/teamviewer-flaw-lets-remote-computers.html
• Chromium: CVE-2026-118304 Improper input validation in SVG — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118304
• Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor — https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html