The PHP project released patches Wednesday for two critical vulnerabilities in a programming language used in an extremely large portion of the internet.

The patch addresses two flaws, catalogued as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 severity scale, which tops out at 10. Researchers describe them as remote code execution vulnerabilities, which could let an attacker run their own code on a server and potentially take control of it. 

The vulnerabilities have been dubbed “php2shell” by researchers. While the industry has spent the past 24 hours sounding the alarm over the vulnerabilities, there has been very little in terms of reported exploitation as of Wednesday afternoon.

In a release, the Cybersecurity and Infrastructure Security Agency said it wasn’t aware of any exploitation.

“While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched,” the release reads.

Multiple researchers have told CyberScoop that they have observed very little activity outside of reconnaissance that is probing to see what vulnerable systems are still connected to the internet.

“We see clear evidence attackers are actively probing and performing reconnaissance across PHP applications,” Kelly Shortridge, chief product officer at Fastly, told CyberScoop. “The gap between disclosure and widespread, repeatable exploitation is typically hours to a few days for vulnerabilities of this severity and attack ROI.”

“We have not observed, or independently confirmed, successful in-the-wild exploitation of these vulnerabilities on live customer systems,” Jon Semon, principal security operations analyst at Huntress, told CyberScoop.

“We have checked across the Linux web servers we have visibility into for the post-exploitation behavior shown in the public proof of concept, such as a web server process spawning a shell that runs recon commands or writes a file into the web root, and did not find activity matching it.”

Neither the technical cause nor a complete list of affected versions has been officially confirmed, with the PHP team saying full details will be published with the release. An advisory from CERT-EU, the European Union’s computer emergency response team, says the flaws could affect every version of PHP from 5 onward. 

The security firm watchTowr said Tuesday the vulnerabilities had been set for release Thursday under embargo. The PHP team moved the release up a day and said it could act sooner still if details became public or exploitation appeared.

A video demonstrating an exploit chain spread online overnight via researcher Kirill Firsov, who shared it and credited researchers known as LCFR and Calif.io. watchTowr said it had reproduced one of the flaws. Code claiming to exploit the flaws is circulating but has not been verified, and security firms caution such code is sometimes laced with malware.

The potential exposure is broad. PHP runs between 70-80% of websites whose server-side language is known, according to market research, and underpins platforms including WordPress, Drupal, Joomla and Laravel. Researchers estimated more than 1.3 million internet-exposed hosts could be vulnerable, and a Shodan search counted about 1.9 million. Among servers that disclose their version, most run branches are no longer receiving security updates: about 758,000 run versions from 5.4 through 8.1, compared with 272,000 on supported branches, according to VirusTotal.

CERT-EU and Britain’s National Cyber Security Centre advised organizations to prepare to update systems quickly and suggested isolating internet-facing applications where immediate patching was not feasible. PHP flaws have been exploited before: the U.S. Cybersecurity and Infrastructure Security Agency’s known-exploited vulnerability catalog lists three in PHP itself, two used in ransomware campaigns.

The vulnerability was discovered by AI cybersecurity firm Calif, using OpenAI’s cybersecurity-focused AI model GPT-5.6 Sol. Wiz, an AI security firm purchased by Google in March, also independently discovered and reported the flaw, according to a blog posted by OpenAI on Wednesday.

The discovery sparked a two-month collaborative effort between OpenAI, PHP maintainers, researchers and security providers to develop a long-term technical fix and prepare for public disclosure.

OpenAI said the priority for all organizations relying on PHP is to apply the new patches, and offered a free tool and other support to help identify vulnerable versions.

“To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender’s Window for maintainers and security providers to prepare fixes and protections ahead of disclosure,” OpenAI wrote in an unsigned blog.

OpenAI also said the PHP flaw is among “several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months.”

In a blog posted the same day, researchers at Wiz said they had discovered “multiple critical vulnerabilities” in PHP, all related to memory safety using GPT-5.6 Sol, their own Wiz Atlas AI tool and Google’s Gemini 4 Argon to conduct their research.

Perhaps most concerning: The bug existed for decades prior to the emergence of modern AI tools, but it’s so complex and technically arduous that few attackers were likely capable of exploiting it.

According to Wiz, it required developing exploits for “notoriously complex” memory bugs that work across different PHP versions, configurations and application behaviors. It would also have to account for differences in PHP deployments that could render the exploit harmless, and each change would require more testing, analysis and debugging.

In the era of AI hacking, “this is no longer a barrier,” the Wiz researchers said.

Large language models can adapt exploits to different PHP versions, configurations or memory layouts, use third-party testing and debugging tools, and carry out a series of other functions for “reducing the specialist effort required for each target.”

“This changes the economics of both discovery and exploitation,” wrote Wiz researchers Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz. “As AI reduces the effort needed to develop and adapt complex exploits, vulnerabilities that once seemed impractical to exploit become viable targets.”

More information is expected over the course of the day. The PHP team is to publish the full advisory with the release, and security firms including Huntress and Tenable said they would update their analyses as technical details and proof-of-concept code emerge.

UPDATE: 10/21/2026, 3:00 p.m. ET: This article was updated to include infromation from CISA and from industry researchers.

The post PHP releases emergency fixes for 2 critical vulnerabilities appeared first on CyberScoop.

Security is foundational to how Ivanti builds, tests, and supports our products. We continue to strengthen our secure product development practices through vulnerability discovery, responsible disclosure processes, security testing, threat-informed hardening, and coordinated response programs. Additionally, we recognize the importance of clear, timely communication when security issues arise. 

To that end, today we are disclosing a vulnerability in limited versions of Ivanti Connect Secure. At the time of disclosure, Ivanti is aware of limited exploitation in the wild. We are working directly with those organizations while making information, updates and remediation available to the broader customer community.  

If you are running one of the impacted versions, Ivanti recommends you act immediately. Additional information related to the impacted versions and remediations can be found in the Security Advisory: 

• Ivanti Connect Secure 

Customers should review the security advisory, upgrade to the fixed version as soon as possible, and run the Integrity Checker Tool regularly.  

As with any security update, applying the fix is an essential step; however, it should be part of a layered security approach that includes strong access controls, network monitoring, log review, and ongoing validation of appliance integrity. 

Patch Tuesday Disclosures 

As part of our regular security program, Ivanti releases standard security patches on the second Tuesday of every month. At the time of disclosure, Ivanti is not aware of exploitation in the wild, and the fixes have been released.  

More information can be found in the Security Advisories: 

• Ivanti Neurons Patch for Intune 
• Xtraction 

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Ivanti releases standard security patches on the second Tuesday of every month. In today’s rapidly evolving technology and threat landscape, we believe responsible transparency should be a cornerstone of any product security program. AI is compressing the time-to-exploit, and Ivanti uses leading technologies to proactively find and fix issues––including integrating advanced LLMs into our Engineering and product security to enhance the capabilities of our teams and identify vulnerabilities that traditional tools have previously missed.

Our philosophy is simple: discovering and communicating vulnerabilities and sharing that information with defenders is not an indication of weakness; rather it is evidence of rigorous scrutiny and a proactive vulnerability management program. By aggressively seeking to identify and address vulnerabilities, our aim is to get ahead of threat actors to ensure our customers can take the steps needed to protect their environments.

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Neurons for ITSM, Endpoint Manager Mobile (EPMM), and Sentry.

It is important for customers to know:

• We have no evidence of these vulnerabilities being exploited in the wild.
• These vulnerabilities do not impact any other Ivanti solutions.

More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in the Security Advisories:

• Ivanti Neurons for ITSM
• Ivanti Endpoint Manager Mobile (EPMM)
• Ivanti Sentry

How we are using AI in product security

Ivanti continues to explore, test, and implement leading technologies and processes in every stage of our product development. Our security team has integrated multiple advanced LLM models into our product security processes.

This has increased the capabilities of our Engineering and Product Security Red Teams to identify and fix vulnerabilities, especially those that are difficult to identify with traditional tooling, such as SAST and DAST. We have already successfully identified vulnerabilities which traditional tools missed, including some that we are disclosing today.

As these tools are integrated further into our processes and refined, we expect an increase in vulnerability disclosures. We will continue to share transparently what we have found and resolved to ensure the security of our products. If you are not already following our Security Blog or subscribed to receive alerts for updates on the products you own through the Ivanti Innovators Hub, we highly recommend you do so.

Importantly, we are committed to using AI responsibly in product security, including keeping a human in the loop to verify automated or agentic work. While this will result in an uptick in disclosures, we see this as a good thing, and an important part of ensuring our products keep pace with modern security requirements as they change.

Our top priority is the security of our customers and believe the increase in identified, resolved, and transparently communicated vulnerabilities demonstrates that commitment.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Ivanti releases standard security patches on the second Tuesday of every month. In today’s rapidly evolving technology and threat landscape, we believe responsible transparency should be a cornerstone of any product security program. AI is compressing the time-to-exploit, and Ivanti uses leading technologies to proactively find and fix issues ––including integrating advanced LLMs into our Engineering and product security to enhance the capabilities of our teams.

Our philosophy is simple: discovering and communicating vulnerabilities, and sharing that information with defenders, is not an indication of weakness; rather it is evidence of rigorous scrutiny and a proactive vulnerability management program. By aggressively seeking to identify and address vulnerabilities, our aim is to get ahead of threat actors to ensure our customers can take the steps needed to protect their environments.

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Neurons for MDM and Endpoint Manager (EPM).

It is important for customers to know:

• We have no evidence of these vulnerabilities being exploited in the wild.
• These vulnerabilities do not impact any other Ivanti solutions.

More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in the Security Advisories:

• Ivanti Neurons for MDM
• Endpoint Manager (EPM)

How AI will affect vulnerability disclosures in our products

Ivanti continues to explore, test, and implement leading technologies and processes in every stage of our product development. In recent months, our security team began a project to integrate multiple advanced LLM models into our product security processes.

This project has increased the capabilities of our Engineering and Product Security Red Teams to identify and fix vulnerabilities, especially those that are difficult to identify with traditional tooling, such as SAST and DAST. We have already successfully identified vulnerabilities which traditional tools missed.

As these tools are integrated further into our processes and refined, we expect an increase in vulnerability disclosures. We will continue to share transparently what we have found and resolved to ensure the security of our products. If you are not already following our Security Blog or subscribed to receive alerts for updates on the products you own through the Ivanti Innovators Hub, we highly recommend you do so.

Importantly, we are committed to using AI responsibly in product security, including keeping a human in the loop to verify automated or agentic work. While this will result in an uptick in disclosures, we see this as a good thing, and an important part of ensuring our products keep pace with modern security requirements as they change.

Our top priority is the security of our customers and believe the increase in identified, resolved, and transparently communicated vulnerabilities demonstrates that commitment.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Ivanti releases standard security patches on the second Tuesday of every month. In today’s rapidly evolving technology and threat landscape, we believe responsible transparency should be a cornerstone of any product security program. AI is compressing the time-to-exploit, and Ivanti uses leading technologies to proactively find and fix issues ––including integrating advanced LLMs into our Engineering and product security to enhance the capabilities of our teams.

Our philosophy is simple: discovering and communicating vulnerabilities, and sharing that information with defenders, is not an indication of weakness; rather it is evidence of rigorous scrutiny and a proactive vulnerability management program. By aggressively seeking to identify and address vulnerabilities, our aim is to get ahead of threat actors to ensure our customers can take the steps needed to protect their environments.

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Xtraction.

It is important for customers to know:

• We have no evidence of these vulnerabilities being exploited in the wild.
• These vulnerabilities do not impact any other Ivanti solutions.

More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in the Security Advisories:

• Xtraction

How AI will affect vulnerability disclosures in our products

Ivanti continues to explore, test, and implement leading technologies and processes in every stage of our product development. In recent months, our security team began a project to integrate multiple advanced LLM models into our product security processes.

This project has increased the capabilities of our Engineering and Product Security Red Teams to identify and fix vulnerabilities, especially those that are difficult to identify with traditional tooling, such as SAST and DAST. We have already successfully identified vulnerabilities which traditional tools missed.

As these tools are integrated further into our processes and refined, we expect an increase in vulnerability disclosures. We will continue to share transparently what we have found and resolved to ensure the security of our products. If you are not already following our Security Blog or subscribed to receive alerts for updates on the products you own through the Ivanti Innovators Hub, we highly recommend you do so.

Importantly, we are committed to using AI responsibly in product security, including keeping a human in the loop to verify automated or agentic work. While this will result in an uptick in disclosures, we see this as a good thing, and an important part of ensuring our products keep pace with modern security requirements as they change.

Our top priority is the security of our customers and believe the increase in identified, resolved, and transparently communicated vulnerabilities demonstrates that commitment.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Ivanti releases standard security patches on the second Tuesday of every month. In today’s rapidly evolving technology and threat landscape, we believe responsible transparency should be a cornerstone of any product security program. AI is compressing the time-to-exploit, and Ivanti uses leading technologies to proactively find and fix issues ––including integrating advanced LLMs into our Engineering and product security to enhance the capabilities of our teams.

Our philosophy is simple: discovering and communicating vulnerabilities, and sharing that information with defenders, is not an indication of weakness; rather it is evidence of rigorous scrutiny and a proactive vulnerability management program. By aggressively seeking to identify and address vulnerabilities, our aim is to get ahead of threat actors to ensure our customers can take the steps needed to protect their environments.

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) and Ivanti Sentry.

It is important for customers to know:

• We have no evidence of these vulnerabilities being exploited in the wild.
• These vulnerabilities do not impact any other Ivanti solutions.

More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in the Security Advisories:

• Ivanti Endpoint Manager Mobile
• Ivanti Sentry

How AI will affect vulnerability disclosures in our products

Ivanti continues to explore, test, and implement leading technologies and processes in every stage of our product development. In recent months, our security team began a project to integrate multiple advanced LLM models into our product security processes.

This project has increased the capabilities of our Engineering and Product Security Red Teams to identify and fix vulnerabilities, especially those that are difficult to identify with traditional tooling, such as SAST and DAST. We have already successfully identified vulnerabilities which traditional tools missed, including some of those disclosed today.

As these tools are integrated further into our processes and refined, we expect an increase in vulnerability disclosures. We will continue to share transparently what we have found and resolved to ensure the security of our products. If you are not already following our Security Blog or subscribed to receive alerts for updates on the products you own through the Ivanti Innovators Hub, we highly recommend you do so.

Importantly, we are committed to using AI responsibly in product security, including keeping a human in the loop to verify automated or agentic work. While this will result in an uptick in disclosures, we see this as a good thing, and an important part of ensuring our products keep pace with modern security requirements as they change.

Our top priority is the security of our customers and believe the increase in identified, resolved, and transparently communicated vulnerabilities demonstrates that commitment.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

In today’s rapidly evolving technology and threat landscape, responsible transparency should be a cornerstone of any product security program. As part of our ongoing product security program, we continually assess, investigate, and address vulnerabilities. When an issue is found, we communicate relevant information as quickly and responsibly as possible.

To this end, we are issuing an important security update addressing vulnerabilities in Ivanti Neurons for ITSM (cloud and on-premises). Customers should review the Security Advisory for more information and version specific details.

Customers using the on-premises Ivanti Neurons for ITSM solution should review the Security advisory and apply fix as soon as possible.

At the time of this publication, we are not aware of any customers being exploited through the vulnerability disclosed today.

Our top priority is the security of our customers and believe the increase in identified, resolved, and transparently communicated vulnerabilities demonstrates that commitment.

Customers and partners with questions about their environment or remediation steps can contact Ivanti Support. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Ivanti releases standard security patches on the second Tuesday of every month. In today’s rapidly evolving technology and threat landscape, we believe responsible transparency should be a cornerstone of any product security program. AI is compressing the time-to-exploit, and Ivanti uses leading technologies to proactively find and fix issues ––including integrating advanced LLMs into our Engineering and product security to enhance the capabilities of our teams.

Our philosophy is simple: discovering and communicating vulnerabilities, and sharing that information with defenders, is not an indication of weakness; rather it is evidence of rigorous scrutiny and a proactive vulnerability management program. By aggressively seeking to identify and address vulnerabilities, our aim is to get ahead of threat actors to ensure our customers can take the steps needed to protect their environments.

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Secure Access Client, Xtraction, Virtual Traffic Manager and Endpoint Manager (EPM).

It is important for customers to know:

• We have no evidence of these vulnerabilities being exploited in the wild.
• These vulnerabilities do not impact any other Ivanti solutions.

More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in the Security Advisories:

• Ivanti Secure Access Client
• Ivanti Xtraction
• Ivanti Virtual Traffic Manager
• Ivanti Endpoint Manager (EPM)

How AI will affect vulnerability announcements in our products

Ivanti continues to explore, test, and implement leading technologies and processes in every stage of our product development. In recent months, our security team began a project to integrate multiple advanced LLM models into our product security processes.

This project has increased the capabilities of our Engineering and Product Security Red Teams to identify and fix vulnerabilities, especially those that are difficult to identify with traditional tooling, such as SAST and DAST. We have already successfully identified vulnerabilities which traditional tools missed, including some of those disclosed today.

As these tools are integrated further into our processes and refined, we expect an increase in vulnerability disclosures. We will continue to share transparently what we have found and resolved to ensure the security of our products. If you are not already following our Security Blog or subscribed to receive alerts for updates on the products you own through the Ivanti Innovators Hub, we highly recommend you do so.

Importantly, we are committed to using AI responsibly in product security, including keeping a human in the loop to verify automated or agentic work. While this will result in an uptick in disclosures, we see this as a good thing, and an important part of ensuring our products keep pace with modern security requirements as they change.

Our top priority is the security of our customers and believe the increase in identified, resolved, and transparently communicated vulnerabilities demonstrates that commitment.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

In today’s rapidly evolving technology and threat landscape, responsible transparency should be a cornerstone of any product security program. Especially with the advancements in AI, we believe it is important to respond quickly when a new risk is discovered.

Ivanti’s efforts integrating AI into our development and product security process have increased the capabilities of our Engineering and Product Security Red Teams to identify and fix vulnerabilities. Our objective in proactively discovering issues is to increase the resilience of our products in today’s threat environment and reduce the likelihood of exploited-in-the-wild Zero Days. We have already successfully identified vulnerabilities traditional tools missed, including some that are being disclosed today.

Importantly, we are committed to using AI responsibly in product security, including keeping a human in the loop to verify automated or agentic work. Our top priority is the security of our customers, and we expect that this work will naturally increase the number of vulnerabilities found, fixed, and disclosed. While this will result in an uptick in disclosures, we see this as a good thing, and an important part of ensuring our products keep pace with modern security requirements as they change.

To this end, we are issuing an important security update addressing vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM).

• More information can be found in the Security Advisory, which describes the nature of the vunlerabilities and detailed remediation instructions for customers.
• At the time of disclosure, we are aware of very limited exploitation of CVE-2026-6973, which requires admin authentication for successful exploitation.
• We are not aware of any customers being exploited by the other vulnerabilities disclosed today.

The issues only affect the on-prem EPMM product, and are not present in Ivanti Neurons for MDM, Ivanti’s cloud-based unified endpoint management solution, Ivanti EPM (a similarly named, but different product), Ivanti Sentry, or any other Ivanti products.

Advanced AI models have collapsed the time-to-exploit from days to hours after disclosure. Because of this, we strongly encourage our customers to apply the patch to their on-premises EPMM promptly to protect their environment.

How AI will affect vulnerability announcements in our products

Ivanti continues to explore, test, and implement leading technologies and processes in our product development. In recent months, our security team began a project to integrate multiple advanced LLM models into our product security processes.

This project has increased the capabilities of our Engineering and Product Security Red Teams to identify and fix vulnerabilities, especially those that are difficult to identify with traditional tooling, such as SAST and DAST. We have already successfully identified vulnerabilities which traditional tools missed, including some of those disclosed today.

As these tools are integrated further into our processes and refined, we expect an increase in vulnerability disclosures. We will continue to share transparently what we have found and resolved to ensure the security of our products. If you are not already following our Security Blog or subscribed to receive alerts for updates on the products you own through the Ivanti Innovators Hub, we highly recommend you do so.

Our top priority is the security of our customers and believe the increase in identified, resolved, and transparently communicated vulnerabilities demonstrates that commitment.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Ivanti releases standard security patches on the second Tuesday of every month.  Our vulnerability management program is central to our commitment to maintaining secure products. Our philosophy is simple: discovering and communicating vulnerabilities, and sharing that information with defenders, is not an indication of weakness; rather it is evidence of rigorous scrutiny and a proactive vulnerability management program. By aggressively seeking to identify and address vulnerabilities, our aim is to get ahead of threat actors to ensure our customers can take the steps needed to protect their environments.

We believe that responsible transparency helps protect our customers, and that CVE disclosures are an essential and effective tool to communicate software vulnerabilities. The purpose of assigning a CVE is to provide a beacon to security teams and signal the need for urgent updates.

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Neurons for ITSM (on-premises and cloud).

It is important for customers to know:

• We have no evidence of these vulnerabilities being exploited in the wild.
• These vulnerabilities do not impact any other Ivanti solutions.
• Customers using the cloud version of Ivanti Neurons for ITSM do not need to take any action as the fix was applied on 12 December 2025 to all cloud environments.

More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in this Security Advisory.

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Ivanti releases standard security patches on the second Tuesday of every month.  Our vulnerability management program is central to our commitment to maintaining secure products. Our philosophy is simple: discovering and communicating vulnerabilities, and sharing that information with defenders, is not an indication of weakness; rather it is evidence of rigorous scrutiny and a proactive vulnerability management program. By aggressively seeking to identify and address vulnerabilities, our aim is to get ahead of threat actors to ensure our customers can take the steps needed to protect their environments.

We believe that responsible transparency helps protect our customers, and that CVE disclosures are an essential and effective tool to communicate software vulnerabilities. The purpose of assigning a CVE is to provide a beacon to security teams and signal the need for urgent updates.

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Desktop and Server Management (DSM).

It is important for customers to know:

• We have no evidence of this vulnerability being exploited in the wild.
• This vulnerability does not impact any other Ivanti solutions.

More information on this vulnerability and detailed instructions on how to remediate the issues can be found in this Security Advisory.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Ivanti releases standard security patches on the second Tuesday of every month.  Our vulnerability management program is central to our commitment to maintaining secure products. Our philosophy is simple: discovering and communicating vulnerabilities, and sharing that information with defenders, is not an indication of weakness; rather it is evidence of rigorous scrutiny and a proactive vulnerability management program. By aggressively seeking to identify and address vulnerabilities, our aim is to get ahead of threat actors to ensure our customers can take the steps needed to protect their environments.

We believe that responsible transparency helps protect our customers, and that CVE disclosures are an essential and effective tool to communicate software vulnerabilities. The purpose of assigning a CVE is to provide a beacon to security teams and signal the need for urgent updates.

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Endpoint Manager (EPM).

It is important for customers to know:

• We have no evidence of this vulnerability being exploited in the wild.
• This vulnerability does not impact any other Ivanti solutions.

More information on this vulnerability and detailed instructions on how to remediate the issues can be found in this Security Advisory.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Ivanti Innovators Hub (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

At Ivanti, responsible transparency is a cornerstone of our commitment to customer security and trust. We have a long-standing commitment to provide information that allows our customers and the broader security ecosystem to take proactive measures to safeguard their environments, while mitigating the risks of a rapidly evolving and highly sophisticated threat landscape.

To this end, we are issuing an important security update addressing vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM). More information can be found in the Security Advisory. At the time of disclosure, we are aware of a very limited number of customers whose solution has been exploited.

The issue affects only the on-prem EPMM product. It is not present in Ivanti Neurons for MDM, Ivanti’s cloud-based unified endpoint management solution, Ivanti EPM (a similarly named, but different product), Ivanti Sentry, or any other Ivanti products.

We urge all customers using the on-prem EPMM product to promptly install the Security Update.

As we respond to this situation, we are making the following information available to defenders now:

• Our Security Advisory, which describes the nature of the vulnerabilities and detailed remediation instructions for customers.
• A Technical Analysis that includes affected endpoint specifics and log analysis guidance to support investigation and forensics.

We have a longstanding commitment to responsibly share information through Ivanti channels, as well as through coordination with government agencies and trusted security partners, to help defenders assess risk, prioritize remediation, and deploy defenses effectively. In this case, we determined that early proactive release of technical details concurrent with the patch aligns with responsible disclosure and arms defenders to best mitigate potential exploitation.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Success portal (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Ivanti releases standard security patches on the second Tuesday of every month.  Our vulnerability management program is central to our commitment to maintaining secure products. Our philosophy is simple: discovering and communicating vulnerabilities, and sharing that information with defenders, is not an indication of weakness; rather it is evidence of rigorous scrutiny and a proactive vulnerability management program. By aggressively seeking to identify and address vulnerabilities, our aim is to get ahead of threat actors to ensure our customers can take the steps needed to protect their environments.

We believe that responsible transparency helps protect our customers, and that CVE disclosures are an essential and effective tool to communicate software vulnerabilities. The purpose of assigning a CVE is to provide a beacon to security teams and signal the need for urgent updates.

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Endpoint Manager (EPM).

It is important for customers to know:

• We have no evidence of this vulnerability being exploited in the wild.
• This vulnerability does not impact any other Ivanti solutions.

More information on this vulnerability and detailed instructions on how to remediate the issues can be found in this Security Advisory.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Success portal (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Ivanti releases standard security patches on the second Tuesday of every month.  Our vulnerability management program is central to our commitment to maintaining secure products. Our philosophy is simple: discovering and communicating vulnerabilities, and sharing that information with defenders, is not an indication of weakness; rather it is evidence of rigorous scrutiny and a proactive vulnerability management program. By aggressively seeking to identify and address vulnerabilities, our aim is to get ahead of threat actors to ensure our customers can take the steps needed to protect their environments.

We believe that responsible transparency helps protect our customers, and that CVE disclosures are an essential and effective tool to communicate software vulnerabilities. The purpose of assigning a CVE is to provide a beacon to security teams and signal the need for urgent updates.

To that end, today Ivanti is disclosing a vulnerability in Ivanti Endpoint Manager (EPM).

It is important for customers to know:

• We have no evidence of this vulnerability being exploited in the wild.
• This vulnerability does not impact any other Ivanti solutions.

More information on this vulnerability and detailed instructions on how to remediate the issues can be found in this Security Advisory.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Success portal (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Ivanti releases standard security patches on the second Tuesday of every month.  Our vulnerability management program is central to our commitment to maintaining secure products. Our philosophy is simple: discovering and communicating vulnerabilities, and sharing that information with defenders, is not an indication of weakness; rather it is evidence of rigorous scrutiny and a proactive vulnerability management program. By aggressively seeking to identify and address vulnerabilities, our aim is to get ahead of threat actors to ensure our customers can take the steps needed to protect their environments.

We believe that responsible transparency helps protect our customers, and that CVE disclosures are an essential and effective tool to communicate software vulnerabilities. The purpose of assigning a CVE is to provide a beacon to security teams and signal the need for urgent updates.

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) and Neurons for MDM.

More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in these Security Advisories:

• Ivanti Endpoint Manager Mobile (EPMM)
• Ivanti Neurons for MDM

In addition, Ivanti has issued a Security Advisory for Ivanti Endpoint Manager, which provides mitigation options for vulnerabilities disclosed October 7, 2025.  

It is important for customers to know:

• We have no evidence of any of these vulnerabilities being exploited in the wild.
• These vulnerabilities do not impact any other Ivanti solutions.

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Success portal (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Ivanti releases standard security patches on the second Tuesday of every month.  Our vulnerability management program is central to our commitment to maintaining secure products. Our philosophy is simple: discovering and communicating vulnerabilities, and sharing that information with defenders, is not an indication of weakness; rather it is evidence of rigorous scrutiny and a proactive vulnerability management program. By aggressively seeking to identify and address vulnerabilities, our aim is to get ahead of threat actors to ensure our customers can take the steps needed to protect their environments. At the core, we believe that responsible transparency helps protect our customers.

We believe that responsible transparency helps protect our customers, and that CVE disclosures are an essential and effective tool to communicate software vulnerabilities. The purpose of assigning a CVE is to provide a beacon to security teams and signal the need for urgent updates.

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Endpoint Manager (EPM) and Ivanti Connect Secure, Policy Secure, ZTA Gateways and Neurons for Secure Access.

It is important for customers to know:

• We have no evidence of any of these vulnerabilities being exploited in the wild.
• These vulnerabilities do not impact any other Ivanti solutions.

More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in these Security Advisories:

• Ivanti Endpoint Manager (EPM)
• Ivanti Connect Secure, Policy Secure, ZTNA and nSA

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Success portal (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Ivanti releases standard security patches on the second Tuesday of every month.  Our vulnerability management program is central to our commitment to maintaining secure products. Our philosophy is simple: discovering and communicating vulnerabilities, and sharing that information with defenders, is not an indication of weakness; rather it is evidence of rigorous scrutiny and a proactive vulnerability management program. By aggressively seeking to identify and address vulnerabilities, our aim is to get ahead of threat actors to ensure our customers can take the steps needed to protect their environments. At the core, we believe that responsible transparency helps protect our customers.

We believe that responsible transparency helps protect our customers, and that CVE disclosures are an essential and effective tool to communicate software vulnerabilities. The purpose of assigning a CVE is to provide a beacon to security teams and signal the need for urgent updates.

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Avalanche, Ivanti Virtual Application Delivery Control (vADC) (previously known as vTM) and Ivanti Connect Secure, Policy Secure, ZTA Gateways and Neurons for Secure Access.

It is important for customers to know:

• We have no evidence of any of these vulnerabilities being exploited in the wild.
• These vulnerabilities do not impact any other Ivanti solutions.

More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in these Security Advisories:

• Ivanti Avalanche
• Ivanti vADC
• Ivanti Connect Secure, Policy Secure, ZTA Gateways and Neurons for Secure Access

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Success portal (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Ivanti releases standard security patches on the second Tuesday of every month.  Our vulnerability management program is central to our commitment to maintaining secure products. Our philosophy is simple: discovering and communicating vulnerabilities, and sharing that information with defenders, is not an indication of weakness; rather it is evidence of rigorous scrutiny and a proactive vulnerability management program. By aggressively seeking to identify and address vulnerabilities, our aim is to get ahead of threat actors to ensure our customers can take the steps needed to protect their environments.

We believe that responsible transparency helps protect our customers, and that CVE disclosures are an essential and effective tool to communicate software vulnerabilities. The purpose of assigning a CVE is to provide a beacon to security teams and signal the need for urgent updates.

To that end, today Ivanti is disclosing vulnerabilities in Ivanti Connect Secure and Policy Secure, Ivanti EPM, and Ivanti EPMM.  

It is important for customers to know:

• We have no evidence of any of these vulnerabilities being exploited in the wild.
• These vulnerabilities do not impact any other Ivanti solutions.

More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in these Security Advisories:

• Ivanti Connect Secure and Policy Secure
• Ivanti EPMM
• Ivanti EPM

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Success portal (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.

Ivanti releases standard security patches on the second Tuesday of every month. It is our philosophy that responsible transparency helps protect our customers. CVE disclosures are an essential and effective tool for communicating software vulnerabilities and necessary actions to customers. A CVE serves as a beacon to security teams and signals the need for urgent updates.  

Today, Ivanti is disclosing vulnerabilities in Ivanti Workspace Control. 

It is important for customers to know:

• We have no evidence of any of these vulnerabilities being exploited in the wild.
• These vulnerabilities do not impact any other Ivanti solutions.

More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in these Security Advisories:

• Ivanti Workspace Control (IWC)

Our Support team is always available to help customers and partners should they have any questions. Cases can be logged via the Success portal (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.