Daily Brief
Active intrusions and exposed infrastructure
Over 1,000 GitLab servers vulnerable to ongoing RCE attacks
More than 1,000 internet-exposed GitLab servers remain unpatched against a maximum-severity flaw that is being actively exploited for remote code execution. This matters because exposed management platforms can give attackers direct code execution and a fast path into wider environments.
Check all internet-facing GitLab instances this week and patch or isolate any unpatched servers before they can be targeted again.
Ivanti patches two more Connect Secure zero-days chained in attacks
Ivanti has patched two more Connect Secure flaws that have been chained in zero-day attacks since at least 1 October. The reporting indicates ongoing exploitation against remote access gateways, which makes these appliances high priority for triage and compromise checks.
Review Connect Secure appliances for the latest updates and inspect affected gateways for signs of prior exploitation since 1 October.