{"id":124,"date":"2026-10-31T07:44:09","date_gmt":"2026-10-31T06:44:09","guid":{"rendered":"https:\/\/mspbusiness.com\/en\/it-news\/patchwork-saturday-31-october\/"},"modified":"2026-11-02T15:54:17","modified_gmt":"2026-11-02T14:54:17","slug":"patchwork-saturday-31-october","status":"publish","type":"post","link":"https:\/\/mspbusiness.com\/en\/security\/patchwork-saturday-31-october\/","title":{"rendered":"Patchwork &#8211; Saturday 31 October"},"content":{"rendered":"<p id=\"top\"><strong>This edition focuses on applications and tools you manage for clients. WordPress has an RCE flaw in its update process that attackers have already tried to exploit, a critical flaw in Drupal Commerce is being exploited against online shops, and CISA has added two more flaws from the Ivanti Connect Secure chain to its KEV catalogue. In addition, ransomware is hitting Synology NAS systems running outdated DSM, and a TeamViewer flaw lets an attacker take over a helpdesk.<\/strong><\/p>\n<ul>\n<li><a href=\"#wordpress\">WordPress 7.1.4 fixes RCE flaw in the update process: attackers were already trying it within hours of the patch<\/a><\/li>\n<li><a href=\"#drupal\">Drupal Commerce Core: critical flaw in online shop module already being exploited<\/a><\/li>\n<li><a href=\"#ivanti\">Ivanti Connect Secure: CISA adds two more flaws from the exploited chain to the KEV catalogue<\/a><\/li>\n<li><a href=\"#synology\">Synology NAS systems hit by ransomware via 2024 flaw<\/a><\/li>\n<li><a href=\"#teamviewer\">TeamViewer flaw lets attacker take over a helpdesk employee&#8217;s system<\/a><\/li>\n<\/ul>\n<h4 id=\"wordpress\">WordPress 7.1.4 fixes RCE flaw in the update process: attackers were already trying it within hours of the patch<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Unauthenticated remote code execution in WordPress Core 4.7 up to and including 7.1.3, during a core update using the full WordPress package. During such an update, files are extracted to a predictable folder under wp-content\/upgrade, including the installation script. It is a race condition<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No CVE assigned (advisory GHSA-4w3m-c66w-69mg)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">8.1<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, Wordfence blocked 62,969 attacks in 24 hours, shortly after the patch of 28 October 2026<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, WordPress 7.1.4 (28 October 2026); security fixes are being backported to all supported branches, currently back to 4.7<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>The window in which the flaw works is small: only during a core update with the full package is the installation script temporarily located in an accessible folder. According to <a href=\"https:\/\/thehackernews.com\/2026\/10\/wordpress-rce-flaw-draws-nearly-63000.html\" target=\"_blank\" rel=\"noopener\">The Hacker News<\/a>, Wordfence blocked 62,969 attacks in 24 hours, with two of the largest sources working through small groups of sites for more than fourteen hours. Dutch security news site <a href=\"https:\/\/www.security.nl\/posting\/959744\/WordPress+dicht+lek+dat+aanvaller+code+laat+uitvoeren%2C+aanvallen+gemeld\" target=\"_blank\" rel=\"noopener\">Security.nl<\/a> reports that the attackers call the installation script over and over again, in the hope that one attempt coincides exactly with an update. In the lab, the window lasted only seconds. The bug was reported by Umut Bayram, according to the <a href=\"https:\/\/wordpress.org\/news\/2026\/10\/wordpress-7-1-4\/\" target=\"_blank\" rel=\"noopener\">release notes for WordPress 7.1.4<\/a>.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>A successful attack results in code execution on the web server, without the attacker needing to log in. This is relevant for MSPs that manage many WordPress sites for clients, because updates are often bundled and rolled out at fixed times. The same release also fixes a series of stored XSS flaws and a flaw that can make unpublished Customizer changes visible to visitors who are not logged in.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Update all sites to 7.1.4. Search the access logs for requests to PHP files under wp-content\/upgrade (such as setup-config.php) and check sites for unknown administrator accounts, plugins and PHP files. Roll out full-package updates as quickly as possible, preferably behind a firewall rule that blocks external access to the installation script.<br \/>\n<a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"drupal\">Drupal Commerce Core: critical flaw in online shop module already being exploited<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Access bypass in the Drupal module Commerce Core: certain routes and entity fields are insufficiently protected. Affected are versions before 8.x-2.41 and versions 3.0.0 to 3.3.13. Drupal gives the flaw a risk score of 21 out of 25 (highly critical); it can be exploited without authentication<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-118539 (Drupal advisory SA-CONTRIB-2026-254)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, according to the Drupal advisory of 28 October 2026<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, Commerce Core 3.3.13 for the 3.x branch and 8.x-2.41 for older sites<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>Drupal has not released details of the affected routes and fields. According to <a href=\"https:\/\/www.drupal.org\/sa-contrib-2026-254\" target=\"_blank\" rel=\"noopener\">Drupal&#8217;s advisory<\/a>, an attacker without an account can bypass access controls, potentially causing financial damage to the online shop owner. <a href=\"https:\/\/www.security.nl\/posting\/959769\/Drupal+waarschuwt+voor+misbruik+van+kritiek+lek+dat+webshops+financieel+raakt\" target=\"_blank\" rel=\"noopener\">Security.nl<\/a> reports that Drupal has confirmed exploitation in the wild. The advisory was published by the Drupal Security Team; the flaw was reported by Dan Puccetti, Marcus Johansson and Robert Snyder.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/itdaily.com\/news\/security\/drupal-commerce-cve-2026-118539-access-flaw\/\" target=\"_blank\" rel=\"noopener\">ITdaily<\/a>, attackers can view non-public data and modify data. For an online shop, this concerns orders and amounts, and therefore direct financial damage and customer complaints.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Find out which clients run Drupal Commerce and update Commerce Core to 3.3.13 or 8.x-2.41. Drupal explicitly asks users to check orders for anomalies, so also review orders placed since 28 October. According to ITdaily, the Drupal 7 branch (1.x) falls outside the scope of the advisory.<br \/>\n<a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"ivanti\">Ivanti Connect Secure: CISA adds two more flaws from the exploited chain to the KEV catalogue<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Three chainable flaws in Ivanti Connect Secure. In addition to the previously known authentication bypass, the catalogue now also includes a flaw that allows an authenticated attacker to place files with their own content in a known location (predictable identifiers) and a local privilege escalation (missing authentication for a critical function)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-104935 (authentication bypass and RCE), CVE-2026-118527 and CVE-2026-111357<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">8.6 for CVE-2026-104935; CISA does not give a score for the two newly added flaws<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, CISA added CVE-2026-118527 and CVE-2026-111357 to the KEV catalogue on 30 October 2026; the chain has been exploited since early October<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Partially, Ivanti fixed part of the chain in release 25.1.3.0; CISA calls for mitigations in line with Ivanti&#8217;s instructions<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/www.cybersecuritydive.com\/news\/hacker-ivanti-connect-secure-chained-exploitation\/832983\/\" target=\"_blank\" rel=\"noopener\">Cybersecurity Dive<\/a>, Volexity described a chain of three flaws on 13 October, used by a group Volexity calls UTA0576. The attacker searched for Active Directory data, BitLocker recovery keys and LAPS passwords, and wiped traces from debug and audit logs. Since 30 October, <a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/feeds\/known_exploited_vulnerabilities.json\" target=\"_blank\" rel=\"noopener\">CISA&#8217;s KEV catalogue<\/a> has also included the other two components of that chain, with a deadline of 13 November for the file upload flaw and 2 November for the privilege escalation.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>A Connect Secure appliance sits at the edge of the network and guards access to the internal network. Anyone who takes over the appliance can collect domain data from there. CISA also warns that Ivanti&#8217;s Integrity Checker Tool may miss an intrusion, because commands run in memory. For the privilege escalation, CISA requires a forensic investigation.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Establish which clients run Connect Secure and follow <a href=\"https:\/\/hub.ivanti.com\/s\/article\/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935\" target=\"_blank\" rel=\"noopener\">Ivanti&#8217;s advisory<\/a>. Do not rely solely on the Integrity Checker: have appliances forensically examined, rotate passwords and keys that were accessible via the appliance, and check Active Directory for suspicious LDAP and Kerberos activity.<br \/>\n<a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"synology\">Synology NAS systems hit by ransomware via 2024 flaw<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Ransomware (C3rb3r\/Locked3d) that encrypts internet-facing Synology NAS systems running outdated DSM versions. One victim names the flaw in advisory Synology-SA-24:20 as the likely entry point<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2024-10441 (the likely entry point according to one victim, not confirmed)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, Synology confirmed this on 29 October 2026<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, since December 2024; advisory Synology-SA-24:20 lists which DSM versions are safe<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/www.security.nl\/posting\/959731\/Synology+NAS-systemen+via+oud+beveiligingslek+getroffen+door+ransomware\" target=\"_blank\" rel=\"noopener\">Security.nl<\/a>, affected users came forward on Reddit. In a <a href=\"https:\/\/www.synology.com\/en-global\/company\/news\/article\/C3RB3R\" target=\"_blank\" rel=\"noopener\">statement<\/a>, Synology writes that attackers are exploiting a flaw from December 2024 on devices running outdated DSM, in order to encrypt data and demand a ransom. Nothing is known about the number of victims.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>An encrypted NAS means the loss of files and often also of local backups stored on the same device. For SMEs without a separate copy, that immediately amounts to a business outage. According to a GitHub guide (c3rb3r-rescue), some victims can decrypt their data themselves in certain cases.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Take stock of Synology systems at clients, check the DSM version against <a href=\"https:\/\/www.synology.com\/zh-tw\/security\/advisory\/Synology_SA_24_20\" target=\"_blank\" rel=\"noopener\">Synology-SA-24:20<\/a> and update. Take NAS systems off the open internet, make them accessible via VPN, enable automatic updates and keep backups offline or on a separate system.<br \/>\n<a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"teamviewer\">TeamViewer flaw lets attacker take over a helpdesk employee&#8217;s system<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Integer overflow in the processing of the remote control screen in TeamViewer Full Client (including Portable) for Windows, Linux and macOS and in the Remote Control App for Android, versions before 15.83. This can lead to a denial of service or possibly code execution on the connecting system<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-111585 (TeamViewer bulletin TV-2026-1011)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">8.8<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, TeamViewer reports no known exploitation<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, TeamViewer 15.83 (bulletin of 27 October 2026); separate fix versions are available for older branches<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/www.security.nl\/posting\/959774\/TeamViewer-lek+laat+aanvaller+systeem+van+helpdesk+overnemen\" target=\"_blank\" rel=\"noopener\">Security.nl<\/a>, an attacker can execute code on the system of a helpdesk employee who connects to a system controlled by the attacker. Users do not need to click anything and no passwords are stolen; the employee only has to accept the connection. Remedio reported the flaw to TeamViewer on 14 August; see <a href=\"https:\/\/remedio.io\/research\/vulnerability-disclosures\/remote-code-execution-in-teamviewer\/\" target=\"_blank\" rel=\"noopener\">Remedio&#8217;s explanation<\/a>.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>This affects technicians&#8217; workstations, which often have broad privileges at clients. The same bulletin also fixes CVE-2026-92372, an out-of-bounds write in the screen image decoder on Linux and macOS, and a privilege escalation on macOS. A compromised helpdesk PC could thus become a springboard into multiple client environments. No exploitation has been reported.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Update the TeamViewer clients of technicians and the service desk to 15.83 or later, in line with <a href=\"https:\/\/www.teamviewer.com\/en\/resources\/trust-center\/security-bulletins\/tv-2026-1011\/\" target=\"_blank\" rel=\"noopener\">bulletin TV-2026-1011<\/a>. Until then, do not accept incoming connections from unknown parties, and distinguish between connecting to a client and connecting to an unknown system.<br \/>\n<a href=\"#top\">top ^<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>WordPress fixes RCE flaw in update process, Drupal Commerce exploited, Ivanti Connect Secure chain grows in KEV catalogue, Synology ransomware strikes and TeamViewer flaw threatens helpdesks.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"mspb_bron_id":1169503,"mspb_url_nl":"https:\/\/mspbusiness.com\/security-en-privacy\/patchwork-zaterdag-31-oktober\/","mspb_url_de":"https:\/\/mspbusiness.com\/de\/security\/patchwork-samstag-31-oktober\/","mspb_url_en":"","mspb_beeld_url":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-P.png","mspb_beeld_klein":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-P-400x225.png","mspb_auteur":"Redactie","mspb_beeld_alt":"","mspb_video":"","_yoast_wpseo_metadesc":"WordPress 7.1.4 fixes an RCE flaw already under attack; Drupal Commerce, Ivanti, Synology and TeamViewer also demand immediate action.","footnotes":""},"categories":[3],"tags":[],"layout":[6],"class_list":["post-124","post","type-post","status-publish","format-standard","hentry","category-security","layout-news"],"_links":{"self":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/124","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/comments?post=124"}],"version-history":[{"count":1,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/124\/revisions"}],"predecessor-version":[{"id":125,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/124\/revisions\/125"}],"wp:attachment":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/media?parent=124"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/categories?post=124"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/tags?post=124"},{"taxonomy":"layout","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/layout?post=124"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}