Oct 15, 2026 · 33 min · 10 segments
AI is making vulnerabilities easier to find, but who’s going to fix them? On this episode, Greg Otto talks with Josh Bressers, VulnCheck’s director of coordinated vulnerability disclosure about the…
Josh BressersGuest
Greg OttoHostMatt CapkoGuestUh, Ivanti, this is a security vendor whose products are frequently targeted by attackers.
They disclosed yet another actively exploited zero day vulnerability affecting Ivanti Connect Secure.
The company said only a limited number of customers were already compromised prior to disclosure earlier this week.
Uh, Volexity, a research firm that discovered the exploitation, said in the attacks it observed that the attackers were focused on credential theft, data exfiltration.
So there was an interesting wrinkle here where it looks like this might have been discovered a few months prior, and it just wasn't patched the right way.
So it's actually a trio of zero day vulnerabilities that attackers chained together.
This allowed them to bypass authentication, execute code remotely, and escalate privileges.
Ivanti disclosed and issued a patch for the authentication bypass and remote code execution components of that chain.
The company says this eliminates the primary exploitation path, and it's working to address the remaining vulnerability in a future update.
But what's even more perplexing here, as you noted, is that Ivanti said it initially discovered a portion of this vulnerability during internal security checks back in June.
A company spokesperson said that because the defect was discovered internally, was not actively exploited at the time, it did not meet their threshold for a security update at that time.
It doesn't make sense why Ivanti waited three to four months to get this fixed before it became a problem for its customers.
Uh, Ivanti, this is a security vendor whose products are frequently targeted by attackers.
They disclosed yet another actively exploited zero day vulnerability affecting Ivanti Connect Secure.
The company said only a limited number of customers were already compromised prior to disclosure earlier this week.
Uh, Volexity, a research firm that discovered the exploitation, said in the attacks it observed that the attackers were focused on credential theft, data exfiltration.
So there was an interesting wrinkle here where it looks like this might have been discovered a few months prior, and it just wasn't patched the right way.
So it's actually a trio of zero day vulnerabilities that attackers chained together.
This allowed them to bypass authentication, execute code remotely, and escalate privileges.
Ivanti disclosed and issued a patch for the authentication bypass and remote code execution components of that chain.
The company says this eliminates the primary exploitation path, and it's working to address the remaining vulnerability in a future update.
But what's even more perplexing here, as you noted, is that Ivanti said it initially discovered a portion of this vulnerability during internal security checks back in June.
A company spokesperson said that because the defect was discovered internally, was not actively exploited at the time, it did not meet their threshold for a security update at that time.
It doesn't make sense why Ivanti waited three to four months to get this fixed before it became a problem for its customers.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.