EXPLORINEER
en

DE — heise online

Attacks Exploiting Flaws in Drupal, Ivanti Connect Secure and Synology Are Ongoing

Security1 min read

Attackers are actively exploiting security holes in Drupal Commerce Core, Ivanti Connect Secure, and Synology DSM to break into systems. Several organizations are warning about these attacks, and admins should install the updates now.

What happened

Hackers are using known security flaws in three products. Drupal Commerce Core is a tool for online shops. Ivanti Connect Secure is a remote-access tool that lets workers log in from outside the office. Synology DSM is the operating system for Synology's network storage boxes (NAS). In each case, attackers can take over systems. Some fixes have been ready for years. Others only came out a few days ago.

Key numbers and facts

  • Drupal Commerce: fix is version 3.3.13, or 8.x-2.41 or newer for older branches.
  • Ivanti: three flaws chained together. One is CVE-2026-104935 (CVSS 8.6, rated high). Two newer ones are CVE-2026-111357 (CVSS 8.8, high) and CVE-2026-118527 (CVSS 4.3, medium).
  • Ivanti attacks may have started in early October, according to security firm Volexity.
  • Synology: ransomware gangs are hitting old DSM versions that lack fixes from December 2024.

Some background

A security flaw is a bug that lets someone do things they should not be allowed to do. A CVSS score rates how serious a flaw is, from 0 to 10. Ransomware is malware that locks your files and demands money to unlock them.

Why it matters

These attacks can let criminals take control of shop orders, remote-access gateways, and file storage. Data could be locked or stolen. Attacks on the Ivanti and Synology flaws have gone on for a while, so the risk is already real for anyone who has not updated.

What to watch

  • Shop owners should check their orders for anything that looks wrong.
  • Ivanti users should run its Integrity Checker Tool to look for signs of a break-in.
  • Synology users should update DSM to the newest version as soon as possible.

Glossary

Drupal Commerce Core
A add-on tool for the Drupal website system that lets people sell items online with a shopping cart and checkout.
Ivanti Connect Secure
A remote-access product that lets workers securely connect to company systems from outside the office.
Synology DSM
The operating system that runs Synology's network storage boxes (NAS).
CVSS
A score from 0 to 10 that shows how serious a security flaw is.
Integrity Checker Tool
An Ivanti tool that checks whether files on a device have been changed by attackers.
Volexity
A cybersecurity firm that analyzed the Ivanti attacks and found they began in early October.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

SecurityITmedia

GMO Chairman Kumagai Apologizes Again at Press Conference, Says Social Media Posts "Lacked Consideration"

GMO Internet Group chairman Masatoshi Kumagai held a press conference on November 2 over unauthorized access to the "Onamae.com Desktop Cloud" FX auto-trading VPS and apologized for failing to protect customers. He acknowledged that customer information was leaked, customer assets were damaged, and that a security issue existed, adding that an expert from GMO Cybersecurity by Ierae had pointed out the problem but it was not acted upon. He also apologized again for social media posts that his posts "lacked consideration" for victims.

Security전자신문

KISIA Promotes Cybersecurity Tech Exchange with Indonesia to Support Korean Firms' Market Entry

The Korea Information Security Industry Association (KISIA) said it is expanding local cybersecurity exchanges and cooperation to help Korean security firms enter the Indonesian market. KISIA took part in the SuSEC 2026 conference in Jakarta from the 13th to the 15th of last month, co-hosted by LS Ware and state-owned SUCOFINDO, with more than 200 attendees including government, military, and public sector officials. A consortium including LS Ware is jointly developing an intelligent zero-trust-based integrated threat detection and response platform tailored to Indonesia's security environment.

SecurityITmedia

Rakuten Securities may have leaked data on 362 customer records; unauthorized access hit NTT Data subcontractor

Rakuten Securities announced on October 31 that information on a total of 362 records of some customers who bought "digital benefit bonds" may have leaked. The leak was tied to unauthorized access by a third party to a system provided by an NTT Data subcontractor, which NTT Data says has since been suspended. The affected customers will be contacted individually, and the investigation into the intrusion route is ongoing.

SecurityITmedia

Nico Nico Rent-a-Car Ends Advance Registration of Driver's License Images and Deletes All Stored Images Amid Rising Cyberattacks

Rental car chain Nico Nico Rent-a-Car, operated by Rentas, announced on October 27 that it is discontinuing the advance registration of driver's license images in its official app "Nico Pass." Customers booking through the app must now show their license at the store counter on the day of rental for staff verification. Rentas said the change is meant to strengthen personal information protection amid increasing cyberattacks, that it has deleted all previously stored license image data, and that it has not confirmed any leaks as of October 27.