Ivanti VPN Zero-Day Chain and Exploited Windows Flaw Lead a Record Patch Tuesday

Two actively exploited flaws, in Ivanti Connect Secure VPN appliances and in Windows, carry a federal patch deadline of Friday, October 16, on the largest Patch Tuesday on record. Attackers are also stealing VPN credentials through fake WatchGuard download sites, and two retail groups are recovering from cyberattacks. On the regulatory side, Norway issued a record privacy fine over ad-tech data sharing, and the FTC sued a company accused of exploiting sextortion victims.

Priority at a glance

Ivanti and the Windows flaw are both under confirmed active exploitation, with the same CISA deadline of Friday, October 16. The fake WatchGuard campaign is active right now. Both retail incidents have already happened and are in the response and disclosure phase.

1. Ivanti Connect Secure: three chained zero-days, one fix still pending

What happened. Ivanti has patched CVE-2026-104935 (CVSS 8.6), an authentication bypass and remote code execution flaw in Connect Secure. Volexity found the attack at a customer on October 5. It reports that an actor it tracks as UTA0576 had been exploiting a fully patched appliance since October 3. The actor chained the flaw with a privilege escalation to root that Ivanti will fix "in the coming weeks." Ivanti reports "limited exploitation in the wild." CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on October 13, with an October 16 deadline for federal agencies.

Who is affected. Affected releases include 22.8R2.4, 25.1.2.2, 25.1.1.1 and earlier. The attacker left no web shell and re-ran the exploit for each command. It stole LDAP credentials stored on the appliance, searched Active Directory for LAPS passwords and BitLocker keys, sprayed passwords and wiped logs. Ivanti's Integrity Checker Tool missed the chain because the exploit changes code only in memory.

What to do. — click a step to check it off

1. Upgrade to the fixed release in Ivanti's advisory now, and apply the privilege escalation fix when it ships.
2. Hunt for Volexity's indicators: bursts of requests to /dana-na/auth/url_default/welcome.cgi, an X-DSCGI-PATH header that doesn't match the URL, a hidden /data/.icscap/ directory, and traffic to 108.165.147[.]64.
3. If compromise is suspected, follow CISA's advice: factory reset and upgrade, or rebuild virtual instances. Then reset passwords, reissue certificates and rotate API keys and any directory secrets the appliance could reach.

2. Microsoft fixes a record 1,400-plus flaws, including an exploited Mark of the Web bypass

What happened. Microsoft's October 13 release fixed more than 1,400 CVEs, a monthly record; outlets count 1,407 to 1,413. The priority is CVE-2026-96951 (CVSS 8.8), an exploited Windows Shell security feature bypass. A crafted file sent by email or chat can evade Mark of the Web, the tag that triggers SmartScreen and Office Protected View warnings. The user still has to open the file, but sees no warning. CISA set the same October 16 deadline.

Also in this release. Two other flaws were public before fixes shipped: CVE-2026-108398, a .NET bypass of Windows Defender Application Control, and CVE-2026-92707, a MessagePack-CSharp denial-of-service issue.

What to do. — click a step to check it off

1. Patch workstations first, since the exploited flaw targets users who open files.
2. Until then, block risky attachment types at the email gateway and keep attack surface reduction rules on.
3. Rank the rest by exploitation status and exposure, and move Windows 11 24H2 Home and Pro devices, now out of support, to a supported release.

3. Fake WatchGuard VPN download sites harvest VPN credentials

What happened. Huntress reported on October 13 that attackers are using search engine poisoning to lure people looking for the WatchGuard Mobile VPN with SSL client, which is legitimately offered at watchguard.com. An administrator at a managed service provider searched Bing and landed on watchguard-vpn[.]net. A fake prompt asked for the VPN server, username and password, rejected the first attempt to capture them twice, and sent them to watchguard-ssl[.]online. It then installed the genuine, signed WatchGuard client, so nothing looked wrong.

Who is behind it. Huntress ties the site to an earlier lure, watchguard-vpn[.]com. Microsoft attributes the wider campaign to Storm-2561, which has also imitated F5, Fortinet, SonicWall and Sophos clients. The .net site was offline on October 13; the collector's status was not reported.

What to do. — click a step to check it off, click any code snippet to copy it

1. Block the three domains in DNS filtering, web gateways and email security, and search logs for past connections.
2. If credentials were entered, reset them and review VPN logins from hosting providers or unfamiliar countries.
3. Require phishing-resistant MFA for VPN access, publish official download links internally, and monitor new domain registrations and Certificate Transparency logs for your own brand.

4. Ahold Delhaize and TFG London recover from cyberattacks

What happened. Ahold Delhaize, parent of Albert Heijn, Delhaize, Food Lion and Stop & Shop, took some systems offline after finding a security issue on October 12. It says stores in Europe and the US remain open, some systems are being relaunched, and it has no evidence so far that customer, associate or partner data was taken.

A second retailer, separately. TFG London, owner of Phase Eight, Hobbs and Whistles, detected an attack on October 11. Stores are trading, but several systems remain down. TFG London is still checking whether personal data was affected and has told UK authorities.

What to do. — click a step to check it off

1. Customers should be wary of messages that mention these incidents and never share passwords or card details in reply.
2. Retailers should rehearse trading with core systems offline and test restoring from backups.
3. Suppliers should review integrations with both groups and watch for payment-change fraud.

Compliance and personal data

This section is general information, not legal advice.

Also notable

Touchpoint's Take

Today's thread is the remote access layer. In the Ivanti case attackers exploited the VPN itself, and in the WatchGuard case they stole the logins that open it. Both went after directory credentials and left little trace. Patching closes the door but does not show whether someone already walked through, so pair every edge-device patch with credential rotation and a look at what the device could reach.

The record Patch Tuesday points the same way: teams must rank fixes by exploitation and exposure, and practise running with systems offline, as two retailers are doing now. Behind each incident are shoppers, patients and employees. Clear, timely notification and practical guidance for them is both a legal duty and the mark of a good response.

If you would like help assessing your exposure or breach-notification readiness, Touchpoint Security's team is available to talk.

Sources

• Ivanti: Security Advisory, Ivanti Connect Secure CVE-2026-104935
• Ivanti: October 2026 Security Update
• Volexity: A Series of Unauthenticated Events, Chained Exploitation of Ivanti Connect Secure Zero-Days
• CISA: CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog
• The Record: CISA warns of new Ivanti bug being exploited as latest Patch Tuesday breaks records
• The Hacker News: CISA Urges Immediate Ivanti Connect Secure Updates
• BleepingComputer: Ivanti warns of Connect Secure zero-day exploited in attacks
• Microsoft Security Response Center: CVE-2026-96951
• SecurityWeek: Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
• BleepingComputer: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
• Help Net Security: Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951)
• Huntress: Fake WatchGuard VPN Site Steals Credentials
• Ahold Delhaize: Update on Ahold Delhaize's cybersecurity incident
• SecurityWeek: Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems
• Help Net Security: Phase Eight, Hobbs and Whistles owner joins growing list of fashion retailers targeted by hackers
• Datatilsynet: Microsoft company fined NOK 92 million for unlawfully sharing personal data
• The Hacker News: Xandr Fined a Record €8.6 Million for Relaying Grindr Data
• FTC: FTC sues operator of sextortion relief scheme
• The Record: FTC says company netted at least $60 million charging sextortion victims
• SecurityWeek: Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach
• iRhythm: Notice of Data Event
• SecurityWeek: iRhythm Data Breach Impacts at Least 360,000 People
• Docker: Docker Hub Security Advisory, CVE-2026-105445
• The Hacker News: SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python
• US Department of Justice: Indictment, North Korean IT worker laptop farms
• The Record: Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue