DAILY BRIEFING
Ivanti Connect Secure Exploited as Zero-Day and curl Patches HTTP/2 Code Execution Flaw
Today's briefing covers an actively exploited Ivanti zero-day, a High-severity HTTP/2 memory corruption fix in curl, and strategies for deepfake social engineering drills.
5 stories2 min read
At the same time, critical open-source components are shipping out-of-band updates to address client-side code execution risks. Security teams should prioritize patching edge appliances before auditing internal applications and developer environments for vulnerable library dependencies.
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
CISA has urged immediate updates for Ivanti Connect Secure (ICS) appliances after actively exploited zero-day vulnerability CVE-2026-104935 (CVSS 8.6) was added to its KEV catalog. The flaw allows remote unauthenticated attackers to execute arbitrary commands, leading to credential theft and data exfiltration.
- Why it matters
- Organizations running affected Ivanti Connect Secure appliances are at immediate risk of unauthenticated remote code execution, credential theft, and data loss via active exploitation.
curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
The curl project released version 8.23.0 to fix CVE-2026-92392, a high-severity use-after-free vulnerability in HTTP/2 uploads affecting curl and libcurl versions 8.12.0 through 8.22.0. A malicious HTTP/2 server can corrupt client memory, enabling client-side arbitrary code execution or application crashes.
- What to do
- Update curl and libcurl installations to version 8.23.0 or later.
How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team
Security recommendations highlight the rise of deepfake audio and synthetic video attacks targeting payment processing, help desk MFA resets, and account access. Organizations are advised to conduct structured deepfake readiness drills to identify verification gaps across identity processes.
- Why it matters
- Attackers leverage voice cloning and AI deepfakes to bypass human authentication procedures, risking fraudulent wire transfers and unauthorized privileged account creation.
Global takedown hits network behind 1 billion phishing messages
A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide.
- Why it matters
- No technical details regarding the global phishing takedown were accessible due to bot management controls.
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
The U.S.
Key takeaways
- Patch Ivanti Connect Secure appliances immediately to remediate the CVE-2026-104935 authentication bypass exploited in zero-day attacks.
- Update curl and libcurl to version 8.23.0 to fix the CVE-2026-92392 use-after-free vulnerability affecting HTTP/2 uploads.
- According to a Gartner survey, 62% of organizations reported experiencing deepfake attacks within a 12-month period.