Two Ivanti Connect Secure flaws join the exploited list

CVE-2026-111357 (missing authentication) and CVE-2026-118527 (predictable identifiers) are being used in the wild.

IvantiVPNKEV

Updated 9 Nov 2026

CVE-2026-111357 (missing authentication) and CVE-2026-118527 (predictable identifiers) are being used in the wild.

What to do

Check exposure this week and follow the vendor or investigator guidance in the source report.

Original reporting: CISA

Original reporting: CISA

Discussion

0 comments

Get the Weekly Wire

The week's exploited vulnerabilities and breaches, in one email.

More Vulnerabilities

CriticalVulnerabilities7 Nov 2026

SonicWall patches exploited SonicOS flaw that weakens VPN logins

CVE-2026-19868 lets an attacker with credentials for one login method slip past SAML checks, including SAML-enforced MFA.

CVE-2026-19868VPNMFA bypass

SecurityWeek

CriticalVulnerabilities6 Nov 2026

Attackers hit OpenSSH 'SSHole' flaw within hours of disclosure

A newly disclosed OpenSSH bug can let attackers sign in to accounts that have no password set. Researchers saw exploitation attempts almost immediately, and one honeypot was taken to root. Audit for passwordless accounts and update OpenSSH as soon as your distribution ships the fix.

OpenSSHLinuxRoot access

The Hacker News

CriticalVulnerabilities6 Nov 2026

PHP2Shell RCE flaws keep spreading into industrial software

CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution (CVSS 9.8). Festo has updated fix guidance for FactoryViews and MES4 installs that bundle XAMPP.

CVE-2026-109618PHPOT

daily.dev / Security Boulevard