Threat Digest October 31, 2026: Ivanti, GitLab & Backdoors

Top Stories#

Ivanti Connect Secure attacks escalate to unauthenticated root access

Attackers are chaining three Ivanti Connect Secure vulnerabilities to obtain unauthenticated root access. Internet-facing appliances should be treated as high-priority investigation targets, not routine patching candidates.

Defenders should:

• Identify every internet-facing Ivanti Connect Secure appliance.
• Apply vendor fixes or approved mitigations immediately.
• Remove unnecessary management exposure.
• Preserve forensic evidence before rebuilding systems suspected of compromise.
• Review authentication, web, configuration, and filesystem logs for unauthorized changes.

The reported attack chain is especially serious because successful exploitation can provide privileged control without prior authentication. See the reported Ivanti attack-chain coverage.

CISA adds two Ivanti vulnerabilities to the KEV catalog

CISA added CVE-2026-111357 and CVE-2026-118527, both affecting Ivanti Connect Secure, to its Known Exploited Vulnerabilities Catalog.

Organizations subject to binding operational requirements should check applicable remediation deadlines. All organizations should use the listing as a prioritization signal, verify appliance exposure, and document emergency remediation decisions.

Maximum-severity GitLab flaw exploited in the wild

Attackers have begun exploiting a maximum-severity GitLab vulnerability patched earlier in October, according to reporting that cites CISA. Teams should assume internet-facing GitLab instances are attractive targets for account takeover, source-code theft, CI/CD abuse, and persistence.

Review:

• Recently created users, deploy tokens, personal access tokens, and SSH keys.
• Project membership and permission changes.
• Runner registration and configuration.
• Webhooks, integrations, scheduled pipelines, and CI variables.
• Audit events around administrative and repository activity.
• Outbound connections from GitLab servers and runners.

See BleepingComputer’s report on the GitLab exploitation.

Malicious Claude Code extension planted SSH backdoors

A malicious Claude Code extension distributed through Cursor’s marketplace reportedly exposed as many as 5,000 developers to malware designed to install persistent SSH backdoors. Developer extensions are privileged software supply-chain dependencies, so security teams should inventory them across Cursor, Visual Studio Code, Claude Code, and related environments.

Remove untrusted packages, inspect developer workstations for persistence, and rotate SSH keys that may have been accessible to the malware.

Relevant checks include:

• New or modified SSH authorized keys.
• Unexpected shell startup entries.
• New launch agents, scheduled tasks, or services.
• Recently installed extensions and package artifacts.
• Outbound connections from developer endpoints.
• Reused credentials or tokens present on affected systems.

Read the reported extension-backdoor analysis.

Suspected crypto-theft implant found in Trezor Safe 5 device

Trezor warned of a suspected hardware crypto-theft implant in a Trezor Safe 5 device sold through a reseller in Southeast Asia. Organizations and individuals should verify hardware-wallet provenance and quarantine suspicious devices rather than trusting them after basic inspection.

If tampering is suspected:

1. Stop using the device.
2. Do not enter seed phrases or signing credentials.
3. Move assets using trusted replacement hardware and a verified recovery process.
4. Preserve packaging, purchase records, and device identifiers.
5. Report the issue to the manufacturer and reseller.

See Trezor’s reported warning.

Healthcare disruption continues at University Hospitals

University Hospitals reported continuing operational disruptions following a cybersecurity incident. The incident shows how cyber events can affect clinical operations, scheduling, communications, and access to critical systems even when public technical details remain limited.

Healthcare organizations should maintain offline communications, coordinate clinical and business continuity teams, and preserve evidence while restoration proceeds. Read the reported University Hospitals update.

Analyst’s Take: The strongest prioritization signal in this digest is active exploitation combined with privileged access. Start with Ivanti and GitLab exposure, preserve evidence before rebuilding, and treat developer endpoints as a credential-recovery problem when the extension backdoor may have reached SSH keys or tokens.

Critical Vulnerabilities#

Linux kernel MPTCP flaw enables remote root attacks

Researchers developed an exploit for a critical Linux kernel vulnerability affecting servers running Multipath TCP listeners. The reported impact includes unauthenticated remote command execution as root.

Organizations should determine whether MPTCP is enabled and whether services expose MPTCP listeners. Where MPTCP is not required, restrict or disable it according to the organization’s operating model. Patch affected kernels and monitor for unexpected privileged processes, remote commands, and anomalous network activity.

See BleepingComputer’s Linux kernel coverage.

CVE-2026-61738: SOCFortress CoPilot path traversal

Severity: CVSS 10.0
Affected: SOCFortress CoPilot before 0.1.77
Impact: Authenticated path traversal can write files outside the intended ScoutSuite report directory.

Upgrade to the fixed release, restrict access to the application, and review filesystem changes around report-upload functionality. Investigate unexpected web-accessible files, modified application files, and new processes launched by the service account.

Reference: SOCFortress security advisory.

CVE-2026-61728: SOCFortress CoPilot stored cross-site scripting

Severity: CVSS 9.9
Affected: SOCFortress CoPilot versions addressed by the vendor advisory
Impact: Stored cross-site scripting can execute in other users’ browsers and steal bearer tokens.

Upgrade promptly, invalidate potentially exposed sessions and tokens, and inspect logs for suspicious requests associated with affected report or dashboard content.

Reference: SOCFortress security advisory.

CVE-2026-119597: OpenDeepWiki hard-coded JWT signing key

Severity: CVSS 9.8
Affected: OpenDeepWiki through 2.0.6
Impact: Unauthenticated attackers can forge administrator tokens and access administrative APIs.

Upgrade to a fixed release when available, replace the signing secret with a strong unique value, invalidate existing tokens, and restrict administrative APIs from the public internet. Review administrative activity and token use for unauthorized access.

References: OpenDeepWiki repository and issue 403.

CVE-2026-110799: Vvveb password-reset authentication bypass

Severity: CVSS 9.8
Affected: Vvveb before 1.0.8.7
Impact: Insufficient validation of user and token parameters can enable authentication bypass through password-reset functionality.

Upgrade to 1.0.8.7 or later, review password-reset events, investigate unexpected account changes, and force resets for accounts with suspicious activity.

Reference: Vvveb security advisory.

CVE-2026-119660: MuseBot hard-coded session key

Severity: CVSS 9.8
Affected: MuseBot before 2.0.0
Impact: Unauthenticated attackers can forge administrator session cookies using the hard-coded default session key.

Upgrade to 2.0.0 or later, replace the session key with a strong unique secret, invalidate all existing sessions, and review administrative access logs.

Reference: MuseBot repository.

What Defenders Should Do Today#

Prioritize work in this order:

1. Contain and investigate Ivanti exposure. Locate all appliances, apply fixes or mitigations, restrict access, and preserve evidence before rebuilds.
2. Patch GitLab and inspect for compromise. Review users, tokens, runners, projects, audit logs, and persistence mechanisms. Rotate credentials if compromise cannot be ruled out.
3. Assess developer workstations. Remove the malicious extension, inspect SSH persistence, and rotate keys and tokens exposed on affected endpoints.
4. Patch or restrict MPTCP servers. Disable unnecessary MPTCP listeners, update kernels, and monitor for privileged remote execution.
5. Remediate high-severity applications. Upgrade CoPilot, OpenDeepWiki, Vvveb, and MuseBot, then rotate signing and session secrets.
6. Protect hardware wallets. Verify provenance and quarantine devices associated with suspicious resellers or tampering.
7. Support continuity operations. Healthcare and other critical-service organizations should maintain offline communications and coordinate restoration with operational leadership.
8. Brief leadership on the common risk pattern. Internet-facing edge appliances, developer tooling, and exposed management applications are converging into high-impact intrusion paths.

For broader email-security planning, see our guide to the best email security gateways in 2026. Teams investigating suspected compromise can also review what memory forensics is before collecting volatile evidence.

Technical Notes#

Check Linux systems for MPTCP exposure

Use these checks as a starting point, adapting them to the distribution and kernel-management tooling in use:

# Check kernel version
uname -a

# Check whether MPTCP is enabled
sysctl net.mptcp.enabled 2>/dev/null || true

# Inspect listening sockets
ss -lntup

# Search active configuration for MPTCP settings
grep -Rni --include='*.conf' 'mptcp' /etc/sysctl.conf /etc/sysctl.d 2>/dev/null || true

Do not treat the absence of a simple configuration value as proof that the host is not exposed. Confirm service behavior, kernel support, firewall policy, and network paths.

Review SSH persistence on developer endpoints

On Linux systems, review authorized keys and common startup locations:

# Recently modified SSH authorization files
find /home /root -path '*/.ssh/authorized_keys' -type f \
  -printf '%TY-%Tm-%Td %TH:%TM %p\n' 2>/dev/null

# Inspect user and root shell startup files
find /home /root -maxdepth 3 -type f \
  \( -name '.bashrc' -o -name '.bash_profile' -o -name '.profile' -o -name '.zshrc' \) \
  -print 2>/dev/null

# Review systemd services and timers
systemctl list-unit-files --type=service --state=enabled
systemctl list-timers --all

Preserve suspicious files and timestamps before deleting them. Endpoint detection data, shell history, authentication logs, and process telemetry can help establish scope.

Search for suspicious administrative changes

For GitLab and affected applications, compare current state against a known-good baseline:

Unexpected administrator accounts
New personal access tokens or deploy tokens
Recently added SSH keys
New runners or runner configuration changes
Modified webhooks and integrations
Unexpected scheduled jobs or pipelines
Changes to JWT or session-secret configuration
Password-reset events outside normal user behavior

Avoid rotating secrets without coordinating token invalidation and dependent service updates. Emergency rotation should include a plan for active sessions, automation, CI/CD jobs, integrations, and recovery credentials.

Bottom Line#

Start with internet-facing Ivanti appliances and GitLab instances because this digest identifies both as active exploitation targets, then preserve evidence before rebuilding suspected systems. Treat exposed developer credentials, JWT signing secrets, session keys, and SSH keys as potential compromise paths, and pair every upgrade or mitigation with the corresponding log review and credential action.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.