Ivanti VPN Zero-Days and Record Patch Tuesday Headline Oct. 16 Briefing

On Oct. 16, 2026, security leaders need to track two urgent patching fires: a threat actor chaining three Ivanti Connect Secure zero-days to gain root on fully patched VPN appliances, and Microsoft's record Patch Tuesday fixing over 1,400 bugs including an exploited Windows Shell flaw. Beyond patching, a Minnesota dental group disclosed a material breach to the SEC, a major UK fashion retailer confirmed a cyberattack, GitLab pushed a maximum-severity RCE fix, and Nike hired a former CrowdStrike CISO.

Attackers Exploit Ivanti Connect Secure Zero-Day, CISA Orders Immediate Patching

CISA warned that threat actors are exploiting a zero-day authentication bypass, CVE-2026-104935, in Ivanti Connect Secure versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, enabling remote execution of arbitrary commands, credential theft and data exfiltration. CISA added the flaw to its Known Exploited Vulnerabilities Catalog on Oct. 13, 2026, and urged organizations to update immediately, noting that Ivanti's Integrity Checker Tool may not detect exploitation because threat actor commands execute in memory. (CISA)

CISA Flags Actively Exploited Flaws in Palo Alto, Cisco and Ahsay Products

CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog on Oct. 14, 2026: a Palo Alto Networks PAN-OS code injection flaw (CVE-2026-0322), a Cisco Secure Email Gateway path traversal bug (CVE-2026-76519), and two Ahsay AhsayCBS flaws, an improper authentication issue (CVE-2026-105133) and a command injection vulnerability (CVE-2026-105134). Under Binding Operational Directive 26-04, federal civilian agencies must prioritize rapid remediation of vulnerabilities on publicly exposed assets that grant total control of a system after exploitation. (CISA)

Microsoft's Record Patch Tuesday Fixes Exploited Windows Shell Flaw

Microsoft's October Patch Tuesday fixed more than 1,400 security bugs, including CVE-2026-96951, a Windows Shell command injection flaw already exploited in the wild to bypass Mark of the Web protections after a user opens a malicious file. Researchers noted it is the third Windows Shell flaw exploited this year. Microsoft also patched CVE-2026-102866, a critical SharePoint signature-verification bug that lets unauthenticated attackers hijack accounts, and 55 wormable, zero-click remote-code-execution flaws across DHCP Server, Remote Desktop Gateway and Network Policy Server, which experts urged organizations to prioritize. (Help Net Security)

Park Dental Partners Discloses Breach Impact, Four Class-Action Suits

Park Dental Partners disclosed in an Oct. 13, 2026 SEC filing that unauthorized access identified on Aug. 28, 2026 led to unauthorized acquisition of data, with investigators identifying patients whose protected health information was involved. The Minnesota dental company said it is aware of four state court class-action lawsuits, the first filed Sept. 3, 2026, alleging failure to safeguard patient data and delayed notification. On Oct. 7, 2026, plaintiffs moved to consolidate the cases. Park Dental said it has not identified any unauthorized use of the data or material financial impact to date. (SEC EDGAR)

TFG London Cyberattack Hits Phase Eight, Hobbs and Whistles

TFG London, the UK arm of South Africa's Foschini Group, detected a cyberattack on Sunday, Oct. 11, 2026, that hit IT systems used by its Phase Eight, Hobbs and Whistles brands, while sister brands Inside Story and White Stuff were unaffected. The company activated incident response and business continuity plans, brought in outside cybersecurity specialists, and reported the incident to UK authorities. Stores remain open and trading despite some systems being unavailable, and TFG London said it is still investigating whether personal or other sensitive information was compromised. It is the second UK retailer breach disclosed within a week, after ASOS. (Help Net Security)

Nike Names Former CrowdStrike Executive Adam Zoller as CISO

Nike has appointed Adam Zoller as Chief Information Security Officer, moving him over after nearly two years as CISO at CrowdStrike. Before CrowdStrike, Zoller spent more than five years as Senior Vice President and Global CISO at Providence, where he oversaw cybersecurity for a healthcare system spanning more than 50 hospitals, 1,000 clinics and 120,000 caregivers. Earlier in his career he held security leadership roles at General Electric, including CISO of GE Healthcare and Director of Cyber Intelligence at GE Corporate. (The National CIO Review)

GitLab Patches Maximum-Severity CVSS 10.0 RCE in CI/CD Regex Compiler

GitLab urged administrators of self-managed instances to patch a critical vulnerability, CVE-2026-97229, an integer overflow in its CI/CD Regular Expression Compiler affecting both Community and Enterprise editions, which GitLab scored at the maximum CVSS 10.0 given its remote, low-complexity, no-privilege exploit path. Fixes shipped in versions 19.4.2, 19.3.5 and 19.2.8 on Oct. 12, 2026, with GitLab.com already running the patched release. Rapid7 researchers reproduced arbitrary code execution on an unpatched 19.4.1 image but found an attacker must first commit a malicious CI/CD configuration file to a public project, and reported no confirmed in-the-wild exploitation as of their update, while still recommending urgent, out-of-cycle upgrades. (Help Net Security)