This edition focuses on VPNs, NAS devices and network equipment. Attackers are chaining three flaws in Ivanti Connect Secure to gain root access and bypass the integrity check, while thousands of GitLab servers have yet to patch the actively exploited CI/CD flaw. Synology is warning of C3RB3R ransomware on outdated NAS systems, the Dutch NCSC is reporting attacks on refrigeration systems in Europe and Zyxel has fixed a flaw in GS1900 switches.
- Ivanti Connect Secure: attackers chain three flaws to gain root access and bypass the Integrity Checker
- GitLab: critical flaw in CI/CD regex compiler actively exploited, with servers still exposed in the Netherlands too
- Synology warns of C3RB3R ransomware on NAS systems running outdated DSM versions
- Attacks on refrigeration systems in Europe: Dutch systems also hit via internet exposure and default passwords
- Zyxel fixes flaw in GS1900 switches that lets an attacker on the LAN execute commands
Ivanti Connect Secure: attackers chain three flaws to gain root access and bypass the Integrity Checker
| Vulnerability | Chain of three flaws in Ivanti Connect Secure: an authentication bypass with command execution, a local privilege escalation and a file upload to a known path. Together they give an attacker without an account root access. Affected are 25.1.1.2 and earlier and 22.8R2.5 and earlier |
| CVE number | CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 |
| CVSS score | 8.6 (CVE-2026-104935), 8.8 (CVE-2026-111357) and 4.3 (CVE-2026-118527), according to Ivanti |
| Actively exploited | Yes, since 3 October 2026 according to Volexity. CISA added two of the flaws to the KEV catalogue on 30 October |
| Patch available | Yes. 25.1.1.3 or 22.8R2.6 fixes the two new flaws. The fixes of 13 October (25.1.1.2 and 22.8R2.5) do not cover them |
According to Rapid7, the threat group UTA0576 used an exploit chain to gain unauthenticated root access to a Connect Secure appliance. Volexity observed the exploitation on a device running 22.8R2.4, after which the attackers harvested passwords and queried Active Directory for Windows LAPS passwords and BitLocker recovery keys. Ivanti reports that a limited number of customers had already been exploited before the advisory was published. The first flaw in the chain was patched on 13 October; the two new flaws were added to the advisory on 29 October.
How has this been exploited?
The attackers send a manipulated request to the VPN login page and then use the other two flaws to become root. According to Volexity, the activity evades Ivanti’s Integrity Checker Tool and logs are selectively altered, so a clean scan proves nothing. The request goes via /dana-na/auth/url_default/welcome.cgi, with an anomalous X-DSCGI-PATH header.
What could the consequences be?
A VPN gateway sits between the internet and your customer’s internal network. An attacker who takes over the appliance can see employees’ login credentials and move laterally through the network from there. The Rapid7 post explicitly mentions the theft of AD data. The NCSC had already warned about the first flaw in the chain on 13 October.
What should IT administrators do now?
Update outside the normal patch cycle to 25.1.1.3 or 22.8R2.6. Where possible, preserve memory and logs before restarting or resetting a device. Search the logs for requests to the path mentioned above with anomalous headers, check /tmp/ and /data/.icscap/ for suspicious files and block the IP address 108.165.147[.]64. If you suspect a compromise, follow Ivanti’s recovery steps and replace any passwords the appliance may have seen, including those of service accounts and LAPS.
GitLab: critical flaw in CI/CD regex compiler actively exploited, with servers still exposed in the Netherlands too
| Vulnerability | Integer overflow in the Regular Expression Compiler for CI/CD configurations in GitLab CE/EE, allowing an attacker without an account to execute code remotely. A second flaw in the same compiler was patched earlier |
| CVE number | CVE-2026-97229 (second flaw: CVE-2026-110264) |
| Actively exploited | Yes, CISA added the flaw to the KEV catalogue at the end of October. Shadowserver sees more than 1,000 unpatched servers under attack |
| Patch available | Yes, GitLab 19.4.2, 19.3.5 and 19.2.8 (12 October 2026). GitLab.com has already been patched and GitLab Dedicated requires no action |
BleepingComputer reports that the patch has been available for three weeks, yet according to Shadowserver more than 1,000 internet-exposed servers are still vulnerable and under attack. The second flaw (CVE-2026-110264), patched a month earlier, is still open on more than 11,300 instances, according to Shadowserver. Dutch security news site Security.nl, citing the same scans, reports that in the Netherlands this concerns 14 servers for the first flaw and 175 for the second.
How can the vulnerability be exploited?
An attacker places a specially crafted regular expression in a CI/CD configuration. When it is processed, the compiler overflows, after which the attacker can execute code on the GitLab server. Under certain conditions, no account is required.
What could the consequences be?
A GitLab server holds source code, pipeline secrets and often access keys to production and customer environments. A takeover therefore gives attackers a stepping stone to everything the pipelines can reach. GitLab servers have previously been used in ransomware attacks, and CISA now has six GitLab flaws in its KEV catalogue.
What should IT administrators do now?
Check which self-managed GitLab installations are running in your own environment and at customers, and update to one of the fixed versions or later. If an installation has been running unpatched for months, treat it as potentially compromised: rotate CI/CD variables, deploy keys and tokens, and check the pipeline history for suspicious configurations.
Synology warns of C3RB3R ransomware on NAS systems running outdated DSM versions
| Vulnerability | Ransomware attacks (C3RB3R, also known as Cerber) on Synology NAS devices running outdated DiskStation Manager. Synology says a vulnerability patched in December 2024 is being exploited, but does not say which one |
| CVE number | Not confirmed. The referenced advisory SA-24-20 lists CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445 |
| Actively exploited | Yes, Synology reports ongoing attacks. The first reports came in more than two weeks before the warning |
| Patch available | Yes, DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 or 6.2.4-25556-8, or later |
According to BleepingComputer, Synology has not issued a comparable warning since August 2019. Affected users find a ransom note (read-me3.txt) and encrypted files with the extension .L0CK3D. The attackers are demanding thousands of dollars for the ‘C3rb3r Decryptor’. The number of affected devices is unknown.
How has this been exploited?
The attackers target devices that have not been updated and are reachable via the internet. Shadowserver counts more than 380,000 Synology systems reachable from the internet, although it is unknown how many of these are vulnerable or are honeypots.
What could the consequences be?
For many SMEs, a NAS is where file shares and backups live. If it is encrypted and the backups are on the same device, there is nothing left to restore from. The attackers also warn that recovery using third-party software may damage the files beyond repair.
What should IT administrators do now?
Take stock of the Synology devices at your customers and update DSM to the fixed version or later. Enable automatic updates and take the management interface off the internet. Also keep at least one backup copy outside the NAS itself, so that an encrypted device is not also your only recovery point.
Attacks on refrigeration systems in Europe: Dutch systems also hit via internet exposure and default passwords
| Vulnerability | Refrigeration systems from various vendors that are directly connected to the internet or use default or weak passwords, allowing attackers to remotely change settings such as temperature and defrost cycles |
| CVE number | No CVE assigned |
| Actively exploited | Yes, on 2 November 2026 the NCSC reported attacks in Europe, including in the Netherlands |
| Patch available | No, there is no central patch. The NCSC advises asking the vendor whether the installation is vulnerable and updating immediately, and taking the installation off the internet |
The NCSC is investigating several attacks on refrigeration systems in Europe and is monitoring the situation. Security.nl reported earlier in the day that temperature settings had been altered at Belgian supermarkets.
How has this been exploited?
Attackers log in to refrigeration systems that are reachable from the internet, or exploit vulnerabilities or weak and default passwords. They then change the temperature or defrost cycles so that the refrigeration no longer works properly.
What could the consequences be?
Products can overheat and spoil, creating a food safety risk. On top of that come financial losses, discarded stock and possibly business downtime. For MSPs with customers in retail, hospitality or food production, this is a new area of responsibility: equipment from an installer is often connected, unnoticed, to the same network or to its own internet connection.
What should IT administrators do now?
Ask customers and their suppliers which refrigeration systems are connected to the internet and ask the vendor whether the installation is vulnerable. Take systems off the internet or restrict access to trusted IP addresses, replace default passwords with strong ones, install security updates and monitor the systems. Incidents can be reported voluntarily to the NCSC.
Zyxel fixes flaw in GS1900 switches that lets an attacker on the LAN execute commands
| Vulnerability | Out-of-bounds write in the CGI program of the firmware for the Zyxel GS1900 series (GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48 and -48HPv2), firmware 2.90(xxxx.2)C0 and earlier |
| CVE number | CVE-2026-107441 |
| Actively exploited | No, Zyxel reports no exploitation |
| Patch available | Yes, firmware 2.90(xxxx.3)C0 (for the GS1900-8 this is 2.90(AAHH.3)C0), only for models still within the vulnerability support period |
According to Zyxel’s advisory, published on 3 November, an unauthenticated attacker on the LAN may be able to execute OS commands via a specially crafted HTTP request. The issue was reported by Yegor Vasilenko of Binarly. On the same day, Zyxel also published an advisory on a buffer overflow in various access points, FWA7 devices and a security router.
How can the vulnerability be exploited?
The attacker must have access to the local network and sends a crafted HTTP request to the switch’s management interface. No account is required.
What could the consequences be?
The GS1900 is a widely used switch among SMEs. An attacker who is already on the network, for example via a compromised laptop or guest port, can use this switch to establish a persistent foothold in the network and view or redirect traffic from there.
What should IT administrators do now?
Check which GS1900 models are deployed at customers and install the fixed firmware. Models outside the support period will not receive a patch, so restrict access to the web interface on those devices to a separate management network and plan their replacement.
This article was originally published in Dutch on MSP Business. Read the original →
