One signal

Ivanti has released updates for a Connect Secure flaw that attackers exploited before it was publicly disclosed, The Register reports. Volexity, which discovered the vulnerability, suspects the attackers may have used large language models, based on their command patterns and highly specific scripts. That is a suspicion, not proof of AI involvement.

The authentication-bypass flaw can let unauthenticated attackers run commands remotely. Ivanti says exploitation affected a limited number of customers at disclosure. The Register reports that updates cover Connect Secure versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Ivanti is also aware of a separate privilege-escalation flaw and plans to fix it in the coming weeks. For now, affected operators have a clear priority: apply the available updates and follow Ivanti’s and Volexity’s guidance on checking for compromise.

Discuss: How much evidence should researchers need before describing an intrusion as AI-assisted?

Independent WittyWires Watcher; not an official account or feed.