DEV Community: TMGS Việt Nam

Ivanti Connect Secure Exploitation Puts Credentials and Administrative Data at Risk

TMGS Việt Nam — Tue, 03 Nov 2026 07:10:23 +0000

Attack activity affecting Ivanti Connect Secure highlights the need to investigate credential exposure alongside device compromise. According to The Hacker News, UTA0576 was observed collecting credentials and some Active Directory metadata, conducting server reconnaissance, and searching for administrator passwords and BitLocker recovery keys. Searching for recovery keys does not establish that the attacker obtained them.

CISA added vulnerabilities affecting Ivanti Connect Secure to its Known Exploited Vulnerabilities catalog after exploitation was observed. These include CVE-2026-111357, rated CVSS 8.8: missing authentication for a critical function can allow an authenticated local attacker to elevate privileges. That authenticated local prerequisite remains relevant when assessing the vulnerability individually.

At the attack-chain level, Volexity observed the vulnerabilities being combined with the authentication bypass CVE-2026-104935, used by UTA0576. TMGS therefore recommends assessing how exploitation steps connect when setting remediation priorities. According to the report, Ivanti’s latest release addresses all the vulnerabilities chained and exploited in the observed activity. Updating still needs to be accompanied by an assessment of possible compromise before remediation.

TMGS recommendations

Apply the corrective release following vendor guidance, and verify the update on every managed device in scope.
Preserve available logs and correlate appliance activity with authentication and administrative activity in the associated environment.
Identify accounts and secrets that may have been accessible. Change credentials and revoke sessions according to the investigation’s scope. Review access to BitLocker recovery keys and replace them through established administration procedures if exposure risk is identified.
Include contractor accounts with relevant administrative privileges. Establish who retains logs, changes passwords, and revokes access.

TMGS recommends treating both patch status and the credential exposure assessment as completion criteria. Record gaps in evidence rather than treating a successful update as proof that all access remains secure.

Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/ivanti-connect-secure-va-bai-toan-lo-thong-tin-xac-thuc-i.0779cb44-3a0a-41e5-9636-a9b3cd615077

TeamViewer flaws put support technicians’ machines at risk

TMGS Việt Nam — Tue, 03 Nov 2026 02:50:26 +0000

A TeamViewer vulnerability could crash the application or allow arbitrary code execution on a viewer’s machine, including a support technician’s workstation. Exploitation requires the user to connect to a remote machine controlled or compromised by an attacker. Initiating a support session does not remove that risk.

According to Remedio’s warning, as reported by SecurityWeek, CVE-2026-111585 is an integer overflow in the remote desktop display processing component. It has a CVSS score of 8.8 and affects TeamViewer applications on Windows, macOS, Linux and Android.

TeamViewer says it has not observed exploitation of these vulnerabilities in the wild. The article does not confirm that any Vietnamese businesses were affected.

Patches and related vulnerabilities

Version 15.83 contains the necessary fixes for Full Client, Host, Portable and Remote Control App for Android. Updates are also available for some older versions; the applicable releases are listed in TeamViewer bulletin TV-2026-1011.

On macOS and Linux, the update also fixes CVE-2026-92372, an out-of-bounds write that could allow arbitrary code execution through specially crafted screen image data or a specially crafted .tvs session recording.

On macOS, CVE-2026-92374 involves a TOCTOU race condition and improper symbolic link handling. It could let a local attacker with low privileges install a malicious package and gain root privileges. This requires local access, unlike the remote connection scenario above.

TMGS recommendations

TMGS recommends prioritizing technicians’ and administrators’ machines when reviewing exposure:

Inventory operating systems, application types and versions, including Portable copies. Apply the appropriate patches and verify installation.
Review connections to unfamiliar machines against support requests and the staff who handled them.
Investigate application crashes and security alerts on viewer machines. A crash alone is not evidence of exploitation.
Verify the origin of .tvs recordings before opening them, particularly on macOS and Linux.
Preserve logs, investigate suspicious devices and isolate machines showing signs of compromise under the organization’s incident response procedures.

Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/lo-hong-teamviewer-de-doa-may-ky-thuat-vien-ho-tro-i.329d2ab9-f04a-477c-8875-7e784740c30e

Malicious Claude Code update on Cursor: SSH persistence beyond the editor

TMGS Việt Nam — Tue, 03 Nov 2026 02:30:32 +0000

A malicious version of the official Claude Code extension reached users through Cursor Marketplace as an apparently legitimate update. According to researchers cited by The Hacker News, version 2.1.313 appeared under the legitimate publisher identity. Cursor temporarily closed its marketplace to remove the compromised package.

Behavior beyond the editor

The extension was designed to activate after VS Code started and when its webview opened. It added an attacker-controlled key to the user's SSH authorized_keys file, attempted to enable SSH access, established reverse tunnels, and installed persistence through scheduled tasks, crontab or LaunchAgent, depending on the operating system. It also sent host reconnaissance data over unencrypted HTTP.

According to Cursor, enabling the SSH service required administrator privileges and usually failed on macOS and Windows unless Cursor ran with those privileges. However, SSH keys and persistence mechanisms were installed even when that step failed. Removing the extension therefore does not establish that the machine is clean.

Scope and uncertainty

The malicious release was reported only through Cursor Marketplace; there was no evidence of distribution through Open VSX or Microsoft VS Code Marketplace. How the unauthorized update entered the distribution system remains unclear.

Cursor reported up to 5.000 affected users who installed it between 2:27 a.m. and 1:35 p.m. Pacific time on 29/10/2026. This count does not establish that backdoor access succeeded on every machine.

As of 30/10/2026, the malicious release had been removed, and Anthropic had released version 2.1.314 on Open VSX and Microsoft VS Code Marketplace.

TMGS recommendations

TMGS recommends identifying exposed machines by extension version, installation source and installation time, with explicit time zones in logs. Isolate suspect machines and preserve evidence before cleanup. Review unfamiliar SSH keys, persistence mechanisms, SSH activity and reverse tunnels; remove unauthorized components after verification. Revoke sessions, rotate potentially exposed credentials and check machines again after remediation. Assign responsibility for developer machines, including partner-managed devices with enterprise access.

Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/claude-code-gia-mao-va-dau-vet-ngoai-trinh-soan-thao-i.4f876629-d89e-4cc6-abe0-7f80511b3379

Alpine Linux incident shows why GitLab updates need Ruby verification

TMGS Việt Nam — Tue, 03 Nov 2026 02:20:27 +0000

Alpine Linux had upgraded to GitLab 19.3.6, but its environment remained vulnerable to CVE-2026-97229. Its container image used standard Ruby, where the vulnerability resided. The incident shows why an application version alone cannot establish that the vulnerable dependency has been fixed.

What happened

CVE-2026-97229 has a CVSS score of 10/10 and stems from insufficient regular expression validation in Onigmo, Ruby’s regular expression engine. GitLab said the flaw could allow unauthenticated users to execute arbitrary code on the server through specially crafted regular expressions in CI/CD configuration.

On October 20 and 21, a threat actor targeted Alpine Linux’s GitLab server. According to Alpine Linux, the attacker used newly registered accounts to submit specially crafted CI configuration, causing worker processes to crash. Those crashes were observed; server-side code execution remained uncertain.

The attack was reported as unsuccessful. Alpine Linux, however, said it had found no evidence that the attacker executed code on the server while acknowledging that it could not rule out that possibility.

Alpine Linux rebuilt the server from scratch. Its checks found no tampering with the aports repository, packages, or releases dated October 21. Those findings apply to the named assets and do not resolve the uncertainty about code execution.

TMGS recommendations

TMGS recommends that organizations operating their own GitLab deployments verify dependencies before closing patch tickets:

Inventory the deployed GitLab and Ruby versions and the container image’s origin.
Confirm that remediation addresses the vulnerable component, then verify the running environment after updating.
Assign responsibility for verification across application and infrastructure teams.
Preserve logs covering new accounts, CI configuration changes, and worker failures when suspicious activity appears.
Check source code and release package integrity when server compromise is suspected.

The acceptance criterion should be evidence that the vulnerable component has been addressed in the running system.

Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/cap-nhat-gitlab-chua-du-neu-ruby-van-con-loi-i.e37b9fea-7b5b-43c8-8af6-cf78a9127596

WordPress Core Update Flaw Exposes Risks in Staging Directories

TMGS Việt Nam — Tue, 03 Nov 2026 02:10:29 +0000

A vulnerability in the WordPress Core update process involves predictable staging paths that are accessible through the web during upgrades. According to Defiant, the race condition can be exploited without authentication and could lead to remote code execution. Attack complexity is rated high, so remote accessibility alone does not establish that exploitation will succeed.

Patch and technical scope

The vulnerability was patched on October 28 in WordPress 7.1.4, with fixes backported to branches from WordPress 4.7 onward. It has not yet been assigned a CVE ID.

The patch randomizes staging directories, adds index protection, and prevents unsafe handling of staging configuration data. These changes address directory predictability and staging data handling. The published information does not establish the precise timing conditions or complete exploitation sequence, nor does it explain the individual role of each change in sufficient detail.

Reported exploitation and evidence limits

Defiant warned that threat actors began exploiting the vulnerability within hours of the patch release. However, Wordfence had not reported any successful compromises. Reported exploitation activity and confirmed compromise must remain distinct when assessing exposure or briefing leadership.

A suspicious web request needs supporting evidence from the system before investigators conclude that a server was compromised.

TMGS defensive recommendations

TMGS recommends that organizations running WordPress:

Inventory installations, verify installed versions, apply the appropriate fix for each branch, and check the update results.
Review web access to temporary and staging directories, applying suitable restrictions after compatibility checks.
Correlate web access logs with upgrade times and investigate unusual requests alongside unexpected file changes, configuration changes, or code execution.
Maintain backups with tested recovery procedures and limit web process privileges to reduce the impact of a compromise.

Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/lo-hong-cap-nhat-wordpress-rui-ro-tu-staging-i.9d15fb9c-460e-43c1-8e51-4f19b6f8d538

CISA adds exploited GitLab and Cisco vulnerabilities to KEV

TMGS Việt Nam — Mon, 02 Nov 2026 03:35:32 +0000

CISA has added vulnerabilities affecting GitLab Community Edition, Enterprise Edition, and Cisco ASA and FTD firewall software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of ongoing exploitation. TMGS recommends prioritizing affected systems for patching and reviewing suspicious activity.

Technical impact

CVE-2026-97229, rated CVSS 10.0, is an integer overflow or wraparound vulnerability in GitLab. Insufficient regular expression validation in CI/CD configuration can allow unauthenticated users to execute arbitrary code on the server.

According to NVD, affected versions are 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Alpine Linux reports that the fix involves a Ruby patch included in official GitLab packages. Updating GitLab alone is insufficient for installations built with a separate Ruby runtime. TMGS recommends checking that runtime and using Ruby 3.3.13, 3.4.12, 4.0.9 or later, as applicable.

CVE-2026-76418, rated CVSS 8.6, affects Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. An unchecked return value leads to a NULL pointer dereference, potentially allowing an unauthenticated remote attacker to trigger unexpected restarts and denial of service.

Alpine Linux incident findings

Alpine Linux reported that an unidentified actor attempted to exploit its unpatched GitLab system, causing worker crashes. Later attempts were blocked. Maintainers found no evidence of successful exploitation but could not rule it out, so they treated the system as compromised and rebuilt it. This incident does not confirm a successful intrusion into Alpine Linux.

TMGS defensive recommendations

Inventory affected assets, prioritize Internet-accessible systems, apply fixes, and verify updates.
Review GitLab worker crashes, unusual CI/CD configuration changes, and unplanned firewall restarts alongside other evidence before concluding that compromise occurred.
Restrict management interfaces and review access permissions while patching proceeds.
Preserve logs, verify recovery capabilities, and activate incident response when suspicious signs appear.

Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/cisa-dua-lo-hong-gitlab-va-cisco-vao-kev-i.9572ee95-6c22-4262-b06b-93e2fc1174d9

Drupal Confirms Active Exploitation of Commerce Core Access-Control Flaw

TMGS Việt Nam — Mon, 02 Nov 2026 03:27:03 +0000

Drupal has confirmed active exploitation of an access-control vulnerability in Commerce Core. Tracked as CVE-2026-118539, the flaw affects versions before 2.41 and versions from 3.0.0 to before 3.3.13. Organizations using affected releases for online stores or transaction management systems should assess their exposure.

Technical facts and known limits

Some Commerce Core routes and entity fields lack sufficient access protection, creating a possibility of bypassing access controls. Drupal considers the issue very serious, but the source provides no CVSS score. An access-control bypass could have financial consequences for vendors.

Drupal has not disclosed exploitation methods or the scale of the activity. The available information does not establish which organizations are being targeted, how widespread exploitation is, or who is responsible. No specific indicators of compromise are provided.

TMGS defensive recommendations

TMGS recommends prioritizing the following actions:

Inventory Drupal websites and applications using Commerce Core, and compare their installed versions with the affected ranges.
Coordinate upgrades with operations teams: update the 3.x branch to 3.3.13 and older versions to 8.x-2.41. Verify the installed version after the update.
Review application and system logs for unusual access or unauthorized activity involving Commerce Core routes and entity fields.
If suspicious access is found, assess related transactions and data changes, document the incident, and follow internal incident-response procedures as needed.
Monitor Drupal announcements for further information about affected systems and exploitation.

For businesses in Vietnam using Commerce Core, TMGS recommends starting with version verification to determine whether their deployments are affected.

Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/drupal-canh-bao-commerce-core-bi-khai-thac-i.e2279eb0-3b0c-4ea9-8e37-0b3187cf0cb5