Search — “CVE-2026-104935”

Ivanti Connect Secure gateways were compromised via two zero-days chained with the authentication bypass CVE-2026-104935, with exploitation reported since at least October 1, 2026, per Volexity and Defused as cited by BleepingComputer. Volexity attributes the activity to UTA0576, which gained unauthenticated root-level code execution, deployed no malware or web shell, re-exploited the device for each command, and tampered with logs. Hunters should look for anomalous ICS behavior and log tampering rather than relying on a clean Integrity Checker Tool result.

An Eclypsium InfraTrust Pulse report (covering September 18 to October 14) lists actively exploited vulnerabilities across network appliances and warns that PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) affect PHP embedded in appliance management interfaces. Because vendors compile PHP into firmware, customers must wait for vendor firmware updates. InfraTrust recommends keeping PHP-backed management interfaces off the Internet until patches arrive; the sources do not describe confirmed PHP2Shell exploitation in the wild.

Per the brief, an authentication-bypass zero-day in Ivanti Connect Secure, tracked as CVE-2026-104935, has been exploited since October 1, with honeypots logging 105 exploit attempts. The brief says the flaw was only partially patched in an earlier July fix. No source text was available, so no technical behaviors, artifacts, or indicators could be verified.