Daily Brief
Patch Tuesday and Ivanti zero-day exploitation
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
Microsoft’s October Patch Tuesday fixes 1,411 flaws, including one actively exploited and two publicly disclosed zero-days. This is important because it combines an unusually large patch set with confirmed exploitation, so delay increases exposure across Windows environments.
Prioritise patching the actively exploited and publicly disclosed issues first, then verify deployment on internet-facing Windows systems this week.
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
Volexity says an attacker chained three zero-day flaws in Ivanti Connect Secure to run commands as root without logging in. Ivanti has fixed two flaws and told customers to act immediately, while a fix for the third is still pending, making this a current remote-access risk.
Identify all Ivanti Connect Secure appliances, apply the available fixes immediately, and treat any exposed or unpatched device as urgent this week.