CISA confirms attackers are chaining three Ivanti gateway flaws
CISA added CVE-2026-111357 and CVE-2026-118527 to its exploited-vulnerability catalogue on 30 October. Together with the earlier CVE-2026-104935 authentication bypass, the chain can move from unauthenticated appliance access to root privileges and attacker-controlled file placement on Ivanti Connect Secure.
Why it matters to you
A compromised VPN gateway can expose identity infrastructure, internal routes and reusable credentials. Upgrade affected Connect Secure releases using Ivanti's latest advisory, preserve traffic and authentication evidence outside the appliance, rotate reachable LDAP and service credentials, and investigate exposed systems rather than assuming an update removes prior access.
A Linux MPTCP flaw enables remote commands as root
Anthropic disclosed CVE-2026-98432, a use-after-free race in the Linux networking stack. Its proof of concept can remotely defeat kernel address randomisation and execute an attacker-chosen command as root on servers exposing a Multipath TCP listener, without credentials or user interaction.
Why it matters to you
This is directly relevant to network-facing Linux infrastructure. Update to a maintained kernel containing the upstream fix, inventory whether MPTCP is enabled or listening, filter unnecessary exposure at the firewall, and rebuild or investigate any server showing unexpected MPTCP handshakes or privileged process execution.
Attackers exploit Drupal Commerce to place fraudulent orders
Drupal says CVE-2026-118539 is being exploited against Commerce Core. Insufficient protection for routes and entity fields can allow an access bypass with financial impact, including suspicious or fraudulent orders on both full-stack and headless commerce sites.
Why it matters to you
A SaaS transaction can be technically valid while bypassing business authorization. Upgrade Commerce Core 3.x to 3.3.13 or earlier branches to 8.x-2.41, audit recent orders and payment states for inconsistencies, and add server-side checks that independently verify price, identity and order transitions.
Military AI adoption exposes compute and human-oversight limits
Reuters reports that the Pentagon's large-scale use of Maven analysis during the Iran war quickly exhausted available classified computing capacity. Reported mistakes and outdated underlying data also reinforced the need for humans to challenge model output before consequential action.
Why it matters to you
The same lesson applies to operational SaaS agents: capacity, data freshness and approval are separate controls. Set explicit compute budgets, show source timestamps, require human confirmation for irreversible actions and retain a non-AI operating path when models or infrastructure are unavailable.
One US utility plans for 4.4 GW of data-centre demand
Alliant Energy has 3.4 GW of data-centre load contracted with Google, Meta and QTS and expects to sign roughly another 1 GW within six months. The additional load would begin ramping between 2029 and 2031, while peak demand across its system is projected to rise by more than 60% by 2031.
Why it matters to you
A signed power contract is still not a live cloud region. When assessing future capacity, track transmission build-out, energisation dates, redundancy, fuel mix and network connectivity; keep your SaaS workloads portable until power, cooling and commissioning are complete.