Another Ivanti upgrade—what will it take to close the door on this VPN attack chain? This is Lantern Cybersecurity Daily. Today: BLG’s cybersecurity incident, malicious packages in npm and PyPI, and the upgrade question facing Ivanti customers. Cassidy, let’s start with Connect Secure.
SecurityWeek, with Eduard Kovacs:
Ivanti has released patches for two more Connect Secure (ICS) zero-days that attackers chained with a vulnerability the company disclosed last month. The newly patched bugs are CVE-2026-111357 and CVE-2026-118527. Ivanti added them on Thursday to its October 13 advisory describing CVE-2026-104935, an authentication bypass in the VPN product. According to Ivanti, attacks chaining the three flaws had hit a limited number of customers by the time they were disclosed.
If your team patched Ivanti Connect Secure after the October 13 advisory, there's another upgrade to schedule. SecurityWeek reports those releases still leave two flaws used in the attack chain. Yes, the recently patched VPN goes back in the queue. And this deserves an interruption: attackers chained these flaws against customers, according to Ivanti, and CISA has added both to its known-exploited catalog. Ivanti describes a limited number of affected customers; that doesn't establish whether your appliance was hit. The upgrade targets are 25.1.1.3 and 22.8R2.6. Don't dismiss the file-upload flaw because it scores just 4.3—it's part of the exploited chain, alongside privilege escalation and the previously disclosed authentication bypass. Ivanti says the latest release addresses every vulnerability exploited in that chain. Install the applicable fix, but keep a separate question open: was the appliance already compromised? Closing the entry points doesn't establish that an earlier intrusion is gone.
Here's BLG:
We recently identified limited unauthorised access to a portion of our Microsoft cloud environment in what we now know is a wider campaign of activity targeting Canadian law firms. Our investigation has confirmed that certain files, including files related to clients, were accessed by an unauthorised third party.
Clients of Canadian law firm BLG have a concrete confidentiality concern: the firm confirms an unauthorized party accessed files, including client-related files, in part of its Microsoft cloud environment. Its October 30 statement says affected clients are being contacted directly. That word 'limited' won't tell a client whether their legal matter was exposed. BLG says its controls contained the incident shortly after it happened, and Mandiant is investigating the scope; those are separate pieces of the response. And BLG describes this as part of a wider campaign targeting Canadian law firms—that's the firm's account. The confirmed file access matters here; the reference to Microsoft cloud doesn't establish a Microsoft vulnerability. For BLG clients, the statement points to your relationship partner. I'd ask which files were accessed and what that means for your matter, even while Mandiant's investigation continues.
This one's from Safeguard:
A handful were plainly built to hurt people: an install-time Monero miner that persists through systemd, a dependency-confusion beacon pointed at internal package scopes, an npm package that tries to publish new packages under whatever npm identity installs it, and three PyPI packages that hide an infostealer inside an image and look up their command server from blockchain transaction history.
For teams building with npm or Python packages, Safeguard counts 106 malicious packages in GitHub advisories published October 26th through 28th. But it also says most reached few machines. A hundred and six entries still doesn't mean a hundred and six emergencies for your team. Your dependency history decides that. Safeguard recommends checking lockfiles and build caches against its list; the nastier examples include an install-time miner that persists through systemd and an npm package that tries to publish using the installer's identity. Publishing malware under your account—generous of it. I'd prioritize that check on build runners holding publishing credentials; a package removed from the registry may already have run there. Safeguard's recommendation is to treat a machine that installed a listed version as compromised, then rotate its secrets from a different machine. This is a dated advisory snapshot, not evidence that every listed package stole data—but an installation match deserves an interruption.
If you’re finding Lantern Cybersecurity Daily useful, please subscribe and leave us a review wherever you’re listening. Reviews help other people discover the show, and we’re grateful you’re here.
We’ll be watching November 13, CISA’s remediation deadline for federal civilian agencies to address Ivanti Connect Secure vulnerability CVE-2026-118527. Links to every story are in the show notes, so take a closer look at the ones that caught your attention. That’s Lantern Cybersecurity Daily for today. This is a Lantern Podcast.