# IT Daily Roundup: October 16, 2026

> Oct 16, 2026 · #security #ivanti #nextjs #github #cloud

Ivanti Connect Secure CVE-2026-104935 is being exploited without authentication, Next.js patched two critical RCE flaws, and the GhostAction campaign hit 1,900 GitHub accounts.

## 1. Ivanti Connect Secure: CISA Deadline Was Today for CVE-2026-104935

Ivanti Connect Secure has an actively exploited vulnerability, CVE-2026-104935, with a CVSS score of 8.6. By sending a crafted HTTP request with the `X-DSCGI-PATH` header, an unauthenticated attacker can bypass authentication entirely and execute arbitrary commands on the appliance. Volexity has been tracking the threat actor, labeled UTA0576, since it began exploiting the flaw on October 3. The attacks involve credential theft, Kerberoasting, and log tampering to cover tracks, with no malware or web shell deployed. Honeypots recorded 105 exploitation attempts from 50 IP addresses, mostly based in Singapore and the United States. CISA added the flaw to its Known Exploited Vulnerabilities catalog and set today, October 16, as the patch deadline for federal agencies.

Patches are available for branches 25.1 and 22.8. Branch 22.8 reaches end of life on January 31, 2027, so patching addresses the immediate risk without solving the longer-term version problem. Before patching, check your logs for incoming requests that include the `X-DSCGI-PATH` header. Ivanti recommends rebuilding any compromised appliance from a configuration backup rather than patching in place.

> **Why it matters:** A perimeter VPN gateway that can be accessed without credentials is a serious exposure. CVSS 8.6, active attacks since October 3. The patch is available, so there is no good reason to delay.

## 2. Two Critical Next.js Flaws Allow Server-Side Code Execution Without Authentication

Vercel released an out-of-band patch on October 14, bringing Next.js to versions 16.4.1 and 15.5.28. Three vulnerabilities are fixed, two of them rated critical at CVSS 9.5. CVE-2026-96889 is in the SVG image processing pipeline via the sharp and librsvg libraries: if your application lets external users upload or reference image files, an attacker can supply a crafted SVG and execute code on the server. All Next.js versions from 10.0.0 onward are affected on systems using glibc. The second critical flaw (no CVE assigned yet) is in the `use cache` component and targets App Router applications that use cached components.

On version 15, upgrading Next.js alone is not sufficient. Run `npm ls sharp` and confirm the version is 0.35.5 or later, because an older copy of sharp can stay in `node_modules` even after the framework upgrade. After the patch, rebuild and redeploy your application. There is no workaround for the `use cache` and Server Actions flaws.

> **Why it matters:** Does your application process SVG files from form uploads or external APIs? If so, this is a direct attack path. `npm audit` may miss the second flaw since it has no CVE, so verify the upgrade manually rather than relying on the automated scanner alone.

## 3. GhostAction Hit 1,900 Developer GitHub Accounts Targeting CI/CD Secrets

From October 7 onward, attackers used stolen personal access tokens to plant a malicious GitHub Actions workflow into compromised repositories, named either `security-audit.yml` or `github_actions_security.yml`. The workflow runs on every push and on manual dispatch. It collects secrets available in the CI environment, including cloud credentials, AWS key pairs, npm, Docker Hub and PyPI tokens, AI provider API keys, and GitHub and GitLab tokens, then transmits them to a hard-coded address over plain HTTP. GitGuardian tracked the campaign to more than 30,000 affected repositories across 373 organizations, with attempted extraction of 3,174 secrets. GitHub started blocking the workflow from running on October 9, which limited the impact from later waves.

Check your repositories and their forks for either workflow file going back to August 31. If you find one, treat the environment as compromised and rotate all secrets in that CI configuration. Reviewing GitHub account login activity from August 31 through October 12 is worthwhile for any team managing projects on the platform.

> **Why it matters:** A CI/CD pipeline that holds production cloud credentials gives an attacker a direct path into your infrastructure. Review what you store in GitHub Actions secrets and scope tokens to the minimum permissions actually required. Narrow scopes limit the damage when a token leaks.

---

© 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-10-16-it-daily-roundup.html