Ivanti Connect Secure flaw allows root privilege escalation; exploited in the wild

00:58 GAMING Microsoft Flight Simulator 2024 adds Halo Pelican for Halo's 25th anniversary Microsoft says Microsoft Flight Simulator 2024 has received the Halo Pelican to mark the 25th anniversary of Halo. The text provided gives no further details on price or availability. 00:58 BIG TECH Google and Adobe expand partnership to link Acrobat, Gemini and Search Google says it is expanding its partnership with Adobe, announced at Adobe MAX, to bring Adobe tools into Drive, Gmail, Gemini and AI Mode in Search, and to explore Google DeepMind models for Adobe's apps. 00:58 GAMING Football Manager 27 and FM27 Console launch with Game Pass on Xbox Microsoft says Football Manager 27 has launched for Xbox on PC, while FM27 Console has arrived on Xbox Series X|S, both through Game Pass. New features include Tactical Tweaks, a time-of-day match system and a Shuffle Draft mode. 00:58 GADGET Amazon's Ring launches Ring Robotics with indoor drone and business robot Ring says its new Robotics line includes Ring Drone Cam, a flying indoor camera, and Ring Rover Cam, a security robot for businesses. Rover ships December 16, 2026 for $999.99 and Drone ships January 27, 2027 for $249.99. 00:58 VULNERABILITY · HIGH Cisco BroadWorks flaw exposes sensitive files; exploited in the wild An XML external entity flaw in Cisco BroadWorks lets remote attackers read configuration data without logging in. CISA lists it as actively exploited, and a fix is available. 00:58 VULNERABILITY · MEDIUM Microsoft Office Outlook flaw enables spoofing; exploited in the wild A spoofing weakness in Microsoft Office Outlook is under active attack, according to CISA. Microsoft has released a fix, and US federal agencies have until 2026-11-24 to address it. 00:58 VULNERABILITY · HIGH Ivanti Connect Secure flaw allows root privilege escalation; exploited in the wild A privilege escalation flaw in Ivanti Connect Secure can let an attacker gain root access. CISA lists it as actively exploited, and a patch is reported to be available. 00:58 VULNERABILITY · CRITICAL PHP flaw allows remote code execution; exploited in the wild A critical memory-handling flaw in PHP, tracked as CVE-2026-109619, can let remote attackers run code on affected servers. CISA lists it as actively exploited, and a fix is available. 00:58 VULNERABILITY · CRITICAL PHP memory flaw allows remote code execution; exploited in the wild A memory-handling flaw in PHP that can lead to remote code execution is being actively exploited, according to CISA. The PHP Group has released fixes, and Cisco and Fortinet have published advisories for their own products. Yesterday PATCH TUESDAY Microsoft Patch Tuesday, November 2026: Exploited Outlook spoofing flaw Microsoft's November 2026 release fixes 1094 vulnerabilities, 63 of them rated critical. Microsoft lists one, an Outlook spoofing vulnerability (CVE-2026-124194), as exploited, and it should be patched first. Yesterday AI Google makes Gemini 4 Carbon available to developers Google says developers can start building with Gemini 4 Carbon today. The company describes it as its strongest model, aimed at long-running agentic workflows and cybersecurity tasks. Yesterday AI NVIDIA CEO Jensen Huang apologizes to staff as board opens investigation NVIDIA published an email in which CEO Jensen Huang apologizes for infidelity. He also says the board has started an independent investigation into national security concerns raised in news reports. Yesterday AI Google makes Gemini 4 Carbon available to developers, businesses and consumers Google says its Gemini 4 Carbon model is now available through its API, Gemini for business and, for Google AI Ultra subscribers, several consumer products. The company priced it the same as Gemini 4 Argon. Yesterday GADGET Microsoft says GTA VI will stream on Xbox One via Xbox Cloud Gaming on November 19 Microsoft says Grand Theft Auto VI launches November 19 and will be playable on day one through cloud streaming on Xbox One and Xbox Series X|S, starting at 1am ET. Pre-loading is available now. Yesterday AI NVIDIA board opens independent investigation tied to reports on CEO Jensen Huang NVIDIA's board says it is starting an independent investigation after recent reporting that CEO Jensen Huang was the target of a foreign intelligence effort. The board says it has no reason to believe national security or company secrets were compromised. Yesterday VULNERABILITY · CRITICAL GitLab CE and EE flaw allows remote code execution; exploited in the wild A critical flaw in GitLab Community Edition and Enterprise Edition can let an attacker without an account run code on the server. It is being actively exploited, CISA has added it to its KEV catalog, and fixed releases are available. Yesterday VULNERABILITY · HIGH SonicWall SonicOS SSLVPN flaw bypasses SAML login and MFA; exploited in the wild A flaw in the SSLVPN service of SonicWall SonicOS can let someone holding valid credentials for another login method get around SAML authentication and SAML-enforced MFA. It is being exploited, and fixed releases are available. Yesterday VULNERABILITY · CRITICAL Atlassian Data Center flaw exposes server files; exploited in the wild A critical file access flaw in several Atlassian self-managed products, including Jira, Confluence and Bitbucket, lets unauthenticated attackers read certain files. It is being actively exploited, and fixed versions are available. Yesterday VULNERABILITY · CRITICAL BeyondTrust Remote Support flaw allows file operations; exploited in the wild A critical authentication bypass in BeyondTrust Remote Support lets attackers carry out file operations on the appliance. CISA lists the flaw as actively exploited, and a fixed version is not confirmed in the data available to us.