❄️ What the French Supermarket Attacks Mean for MSPs

Overnight on October 11 and 12, refrigerators and freezers in hundreds of French supermarkets began to warm up. By morning, display cases had reached around 50 °C, stores were throwing out their fresh and frozen stock, and the Paris prosecutor's office was investigating what it called a "large-scale cyber-attack," according to BleepingComputer…

⚠️ Threat Updates

🔴 Ivanti Connect Secure Zero-Day Chained for Root Access on Fully Patched VPNs (10/14/26)

Ivanti has patched CVE-2026-104935 (CVSS 8.6), an authentication bypass in Connect Secure VPN appliances that a remote attacker can use to run commands without logging in. CISA added it to the Known Exploited Vulnerabilities catalog on October 13. Volexity found a previously unknown actor, UTA0576, exploiting it since October 3. The actor chained the bypass and a code-execution bug, both covered by CVE-2026-104935, with a third privilege escalation flaw that is not yet patched, gaining root on an appliance running 22.8R2.4, then the latest release. The actor deployed no malware or web shell. It re-ran the exploit for every command and tampered with logs to evade Ivanti's Integrity Checker Tool, then focused on credential theft, Active Directory reconnaissance and data exfiltration. Affected versions are 22.8R2.4 and earlier, 25.1.1.1 and earlier, and 25.1.2.2 and earlier, while 22.7R2.14 and earlier are not affected. Watch for Ivanti's fix for the privilege escalation flaw, and plan to move off 22.8 before its January 31, 2027 end of life. » More Info

🔴 Exploited Windows Shell Zero-Day Lets Malicious Files Skip Mark of the Web Warnings (10/14/26)

Microsoft's October Patch Tuesday fixes CVE-2026-96951 (CVSS 8.8, rated Important), a Windows Shell command injection flaw that lets a crafted file evade Mark of the Web, the tag that triggers SmartScreen warnings and Office Protected View for files from the internet. Microsoft confirms exploitation in the wild, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 13 with an October 16 federal deadline. It is the third Windows Shell zero-day exploited this year. An earlier one was tied to APT28, but no one has attributed this campaign or published attack details. Exploitation still requires a user to open a file delivered by email, chat tools like Teams or Slack, or a malicious download. The flaw removes the warnings rather than executing code on its own, which makes it a natural first stage for phishing payloads. For MSPs, every managed Windows endpoint and server is in scope, so push the October cumulative update through RMM now instead of waiting for normal patch rings. Confirm installation across every client, and start with users who handle outside files, such as finance, HR and executive staff. Hunt for Office apps, archive tools or browsers spawning script hosts or command shells, especially on devices where patching lagged, and remind users that a missing warning doesn't make a file safe. » More Info

🗨️ Parting Words

“I am thankful to all who said no to me. It is because of them that I’m doing it myself.” — Albert Einstein

Are you a vCISO or MSP looking to operationalize security programs? Let’s discuss how Blacksmith Infosec proves that compliance is an opportunity, not a struggle that has to be packaged in FUD!