--- title: "Security digest: October 13, 2026" url: https://erroneo.us/security/2026-10-13/ description: "October 13, 2026 vulnerability digest: 5 briefs (Ivanti Connect Secure CVE-2026-104935: Exploited…); 2 CISA KEV additions (Ivanti, Microsoft); 3 critical…" type: security-digest-day section: "Security Digest" date_published: 2026-10-13 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: October 13, 2026 5 editorial briefs, 2 known exploited (cisa kev) additions and 3 critical advisories. ## Take stock - Act now: Ivanti Connect Secure CVE-2026-104935: Exploited Zero-Day . Every organization running Ivanti Connect Secure 22.8 or 25.1 builds, especially internet-facing VPN gateways. - Patch this week: Visual Studio Copilot CVE-2026-103572: Trailing-Dot RCE . Teams on Visual Studio 2022 17.14 before 17.14.42, Visual Studio 2026 18.10 before 18.10.4, or SSMS with Copilot, especially where agents read untrusted repositories, files or MCP server output. - Patch this week: Windows Shell CVE-2026-96951: Exploited MOTW Bypass . Any organization with Windows 10 or 11 endpoints, or Remote Desktop servers, where people open email attachments, chat files or downloads. - Check exposure: Podman CVE-2026-94603: Images Can Disable the Sandbox . Teams that run images they did not build with rootful Podman (sudo podman run, systemd/Quadlet units as root, CI runners), especially images pulled from public registries or supplied by pull requests. - Most can relax: SlugFest . npm package maintainers who created trusted publisher configurations that never completed a publish, renamed, transferred or deleted a bound repository or GitHub owner, or publish from GitHub Actions issue_comment workflows. - Do you run any of these? Microsoft Windows, Ivanti Connect Secure. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-16. - NuGet: 3 critical advisories ( Microsoft.AspNetCore.App.Runtime.linux-arm , Microsoft.AspNetCore.App.Runtime.linux-arm64 , Microsoft.AspNetCore.App.Runtime.linux-musl-arm , Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 , Microsoft.AspNetCore.App.Runtime.linux-musl-x64 , Microsoft.AspNetCore.App.Runtime.linux-x64 , Microsoft.AspNetCore.App.Runtime.osx-arm64 , Microsoft.AspNetCore.App.Runtime.osx-x64 …). Check with dotnet list package --vulnerable --include-transitive . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Act now** [Ivanti Connect Secure CVE-2026-104935: Exploited Zero-Day](https://erroneo.us/security/briefs/ivanti-connect-secure-cve-2026-104935-zero-day/index.md): Upgrade Connect Secure today and investigate with memory and network forensics, because the Integrity Checker missed this compromise and part of the attack chain still has no fix. - **Patch this week** [Visual Studio Copilot CVE-2026-103572: Trailing-Dot RCE](https://erroneo.us/security/briefs/visual-studio-copilot-cve-2026-103572-rce/index.md): If your developers use Copilot in Visual Studio or SSMS, update this week: exploitation needs only text the agent reads, and the researcher's write-up spells out the chain. - **Patch this week** [Windows Shell CVE-2026-96951: Exploited MOTW Bypass](https://erroneo.us/security/briefs/windows-shell-motw-bypass-cve-2026-96951/index.md): Roll the October 2026 Windows update out to every desktop this week; attackers are using this to make malicious attachments and downloads skip the warnings that would stop them. - **Check exposure** [Podman CVE-2026-94603: Images Can Disable the Sandbox](https://erroneo.us/security/briefs/podman-checkpoint-image-sandbox-bypass-cve-2026-94603/index.md): If you run third-party images with rootful Podman, upgrade to 5.8.8 or 6.1.3 now, because an image can switch off the sandbox you asked for; rootless Podman and trusted-image-only hosts can patch on a normal cycle. - **Most can relax** [SlugFest: npm Trusted Publishing Repo-Name Hijack](https://erroneo.us/security/briefs/slugfest-npm-trusted-publishing-slug-hijack/index.md): The hole was closed on npm's side on October 2, 2026 and no abuse has been reported, so most teams have nothing to patch; maintainers should still spend five minutes auditing trusted publisher bindings and recent publishes. ## Known exploited (CISA KEV) - [CVE-2026-96951](https://erroneo.us/security/cve/CVE-2026-96951/index.md) Microsoft Windows: Microsoft Windows Command Injection Vulnerability (CISA due 2026-10-16) - [CVE-2026-104935](https://erroneo.us/security/cve/CVE-2026-104935/index.md) Ivanti Connect Secure: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CISA due 2026-10-16) ## Critical advisories - [CVE-2026-88092](https://erroneo.us/security/cve/CVE-2026-88092/index.md) Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability — NuGet Microsoft.AspNetCore.App.Runtime.linux-arm >= 8.0.0, <= 8.0.31 → 8.0.32; NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 8.0.0, <= 8.0.31 → 8.0.32; NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm >= 8.0.0, <= 8.0.31 → 8.0.32 - [CVE-2026-70188](https://erroneo.us/security/cve/CVE-2026-70188/index.md) Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability — NuGet Microsoft.AspNetCore.App.Runtime.linux-arm >= 11.0.0-preview.1, <= 11.0.0-rc.1 → 11.0.0-rc.2; NuGet Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 11.0.0-preview.1, <= 11.0.0-rc.1 → 11.0.0-rc.2; NuGet Microsoft.AspNetCore.App.Runtime.linux-musl-arm >= 11.0.0-preview.1, <= 11.0.0-rc.1 → 11.0.0-rc.2 - [CVE-2026-105016](https://erroneo.us/security/cve/CVE-2026-105016/index.md) Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability — NuGet Microsoft.Native.Quic.MsQuic.Schannel = 2.5.11-ci.156755675 → 2.5.11-ci.159417053 --- Source page: https://erroneo.us/security/2026-10-13/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt