Ivanti Connect Secure zero-day chain enables root access

Attackers reportedly chained three Ivanti Connect Secure flaws in activity observed October 3–5 to gain unauthenticated root access, target AD credentials, LAPS passwords, and BitLocker keys, and prepare for lateral movement. Log tampering and password spraying were observed; only two flaws are patched, and the Integrity Checker may have detection limitations. Treat exposed appliances as potentially compromised and prioritize forensic preservation, patching, credential rotation, and downstream identity hunting.