Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team.

This week, Volexity reported an attacker chaining three Ivanti Connect Secure zero-days to gain root, one of which still has no fix. The brief also covers wire fraud charges against a ransomware recovery firm's owner, an FBI and Secret Service warning that FortiBleed, the Fortinet login campaign we covered in June, has fed ransomware affiliates, and PoeLLM, malware that takes its server address from a GitHub poem.

An attacker reruns an Ivanti VPN zero-day chain for every command →

Brief: Starting October 3, an unknown attacker Volexity tracks as UTA0576 chained three zero-days to run commands as root, with no login, on an Ivanti Connect Secure VPN appliance that was fully patched at the time.

Intel: An authentication bypass and a code execution bug are tracked as CVE-2026-104935 and were fixed October 13. Volexity says the third flaw, a privilege escalation to root, has no fix yet. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on October 13, with an October 16 deadline for U.S. federal civilian agencies. From the appliance, the attacker searched Active Directory for local administrator passwords and BitLocker recovery keys, which unlock encrypted drives, and sprayed passwords at domain accounts. Volexity assesses with high confidence this was groundwork for moving deeper into the network.

Why it matters: Volexity found no backdoor, and the attacker reran the full chain for each command. The chain changed a code library only in memory and restored the configuration after each run, so Ivanti's Integrity Checker Tool, which checks files on disk, misses the changes, Volexity says. Its analysts rebuilt the chain from memory captures and core dumps the exploitation left behind.

Recovery firm owner accused of secretly paying ransomware attackers →

Brief: The Justice Department charged Zohar Pinhasi, owner of Florida ransomware recovery firm MonsterCloud, with wire fraud over claims he could decrypt clients' data without paying attackers.

Intel: MonsterCloud's website warned clients against paying ransom, and Pinhasi pitched "proprietary tools" and "advanced decryption techniques." According to the indictment, he had no special decryption technology and paid the cybercriminals for a key, then typically billed clients far more than the ransom. In one August 2023 case, he allegedly paid about $8,200 and charged the client about $150,000. He faces two counts of wire fraud and one count of wire fraud conspiracy, and has pleaded not guilty.

Why it matters: Prosecutors say the decryption key MonsterCloud employees used on clients' files came from the attackers, and that MonsterCloud paid them despite its own website's warning against paying. They put the alleged totals at more than $19 million charged to clients and more than $8 million paid in ransom.

FBI ties FortiBleed firewall logins to ransomware affiliates →

Brief: A joint FBI and U.S. Secret Service advisory says FortiBleed, a campaign stealing logins for Fortinet FortiGate firewalls, remains active and has fed access to ransomware affiliates.

Intel: Initial findings indicate attackers keep scanning internet-facing FortiGates and remote-access VPN gateways with credentials they already hold, and crack passwords stored in an older, weaker format offline. Once in, they add their own admin accounts. The advisory warns that some victims may lose access to their firewalls if attackers delete the original accounts or change the passwords on them. Fortinet says no new vulnerability is involved and points to reused credentials and brute-force attempts on devices without MFA.

Why it matters: FortiBleed's operators sorted stolen logins by each victim's revenue and network layout. In June we had no named buyer for the campaign's access. Now the agencies cite reporting that brokers using the campaign have passed further access to ransomware affiliates, among them INC/Lynx and Payload ransomware.

PoeLLM malware reads a GitHub poem to find its next command server →

Brief: Lumen's Black Lotus Labs found PoeLLM malware hijacking exposed self-hosted AI and developer tools to mine cryptocurrency, running on roughly 800 servers a day at its peak.

Intel: The malware finds its command server through a two-stanza poem on GitHub: four words at set positions each map to a number, and together the numbers form an IP address. Since April 13, 2026, the operator has edited the poem 11 times. Each edit sent infected machines to a new server with no malware update. Lumen says most victims appear to run vulnerable, self-hosted AI services such as LiteLLM and Ollama.

Why it matters: PoeLLM's scans went mainly after ports 3000 and 4000, where Gotenberg, a PDF converter, and LiteLLM listen. Gotenberg's install guide warns against putting it on the internet. Hijacked servers then joined the scanning and attacked other exposed services to find more victims.

Stat of the week: 1,407

The number of CVEs Microsoft patched in its October 2026 Patch Tuesday release, more than the 1,245 it patched in all of 2020, its yearly record through 2025, according to our monthly Patch Tuesday blog.

Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.