Know what changed.
Trace why it matters.

A threat actor used an exploit chain combining three vulnerabilities in Ivanti Connect Secure appliances to breach organizations, collect credentials, exfiltrate configuration data, and conduct network reconnaissance. Volexity reported discovering UTA0576 abusing a zero-day exploit chain in the first week of October 2026 against a fully patched Ivanti Connect Secure appliance running version 22.8R2.4 at the time.

This is a reminder that appliance exposure can remain an operational concern even when an organization’s patch state appears current.

A Linux vhost subsystem flaw, tracked as CVE-2026-74580 and named Vghost, lets a local user read and write kernel memory and become root across nearly a decade of kernel versions. In one virtualization setup, an untrusted virtual machine can write to host memory and hijack the program running the virtual machine.

Guest-to-host separation merits treatment as a distinct assurance boundary, not merely as a consequence of local-access assumptions.

Versions 2.2.0 and earlier of Komodo’s Periphery agent are vulnerable to OS command injection because Docker container names are not properly validated in container-destruction and container-log-search operations. An authenticated attacker, including a non-admin user, can exploit a malicious container name to execute arbitrary commands as root on the underlying host.

The vulnerable commands run with Periphery’s root privileges and access to the host operating system and Docker socket; the advisory says successful exploitation can enable persistence, lateral movement, and infrastructure compromise.