Botwin's Morning Wire

Ivanti has released patches for a critical authentication bypass vulnerability in Connect Secure, identified as CVE-2026-104935, after confirming attackers exploited it in live environments.

The flaw, rated 8.6 on the CVSS scale, permitted remote, unauthenticated access to execute arbitrary commands on affected systems. Volexity researchers discovered the vulnerability and reported active exploitation targeting a limited number of customers prior to Ivanti's disclosure. The company's advisory noted limited indicators of compromise and directed users to Volexity's analysis for mitigation guidance.

Affected versions included 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Ivanti confirmed prior awareness of the vulnerability, having patched a related component in July 2025 updates, but attackers began exploiting it before a full fix could be deployed. Volexity attributed the attacks to an unnamed group now tracked as UTA0576, with suspected criminal motives rather than espionage. Observed activities included credential theft, data exfiltration, and network reconnaissance, though no malware or web shells were deployed.

Researchers noted unusual command-line usage patterns and hardcoded credential scripts, suggesting potential use of large language models for attack automation. Volexity described a multi-stage attack chain involving three distinct vulnerabilities, with the patched flaw handling initial access and remote code execution. A separate privilege escalation vulnerability, unrelated to CVE-2026-104935, remains under investigation with a fix expected in the coming weeks.

This incident marks the third consecutive year Ivanti has addressed zero-day exploits in Connect Secure, following disclosures in January 2025 and earlier incidents linked to thousands of compromised appliances. The company also faces ongoing scrutiny over vulnerabilities in other products, including Endpoint Manager Mobile and Sentry.

Submarine cables carry nearly all international data traffic, linking continents beneath the ocean floor. Their failure can isolate communities, disrupt economies, and compromise national security. Over 1.5 million kilometres of cables support 607 active systems worldwide, forming a critical backbone for global communications.

The Matsu Islands, administered by Taiwan since 1949, rely on three submarine cables — Taima No. 2, Taima No. 3, and Taima No. 4 — to connect to mainland Taiwan. Between 2018 and 2022, these cables were severed 27 times. Four major outages occurred between 2023 and 2025, highlighting vulnerabilities in a region where shallow waters and maritime traffic increase risk. Similar patterns appear elsewhere: the Baltic Sea recorded 11 disruptions since 2023, and the Red Sea experienced cable cuts in February 2024 and September 2025 tied to drifting vessels and conflict zones.

Cable faults stem from multiple sources. Geological events, such as landslides and earthquakes, account for 7% of failures. Component breakdowns contribute 4%, while abrasion and other issues make up the remainder. However, 86% of incidents trace back to maritime activity, primarily fishing gear or anchor drag. In territorial waters, where most faults occur, jurisdiction over cable repairs rests with coastal states, complicating timely interventions.

Resilience strategies involve layered protections. Cables near shore use steel-armored jackets to resist ship contact, while deep-sea segments rely on simpler designs vulnerable to dragging anchors. Landing stations, often located in low-traffic coastal zones, face risks from nearby shipping. Protective zones, enforced under the United Nations Convention on the Law of the Sea, restrict anchoring within 12 nautical miles of shore, yet enforcement remains inconsistent.

Historical precedents underscore deliberate sabotage’s impact. During World War I, British forces severed German cables to disrupt communications, forcing reliance on vulnerable radio channels. Similar tactics occurred in World War II, with cables cut to isolate Axis powers. Modern threats include geopolitical tensions, as seen in the Baltic Sea, where Russian naval activity and ambiguous jurisdiction have led to repeated outages.

Repair operations are costly and slow. A single fix can cost $500,000 to $1 million, depending on depth and location. Specialized vessels, pooled through regional agreements, handle most repairs, but aging fleets and rising demand threaten response capacity. Industry projections indicate two-thirds of repair ships will exceed service life by 2040, requiring $3 billion to replace them. Without coordinated investment, delays could stretch to years, as seen in a 2023 incident that took 947 days to resolve due to bureaucratic hurdles.

The ownership landscape is shifting. Tech giants like Google now control over half of the Pacific, Atlantic, and Indian Ocean cable networks, raising concerns about centralized control and sovereign risk. While private funding drives innovation, consolidation risks undermining public accountability. The European Union has begun funding repair fleets, but most nations lack resources to counteract private dominance.

Resilience hinges on diversified routing, rapid repair access, and international cooperation. Choke points like the Bab al-Mandab Strait and Singapore Strait remain high-risk, with 16 and 35 cables respectively traversing these narrow passages. Earthquakes, sediment shifts, and extreme weather further threaten stability.

As digital infrastructure becomes increasingly centralized, the balance between private investment and public resilience grows fragile. Without systemic reforms — streamlined repair permissions, shared repair fleets, and diversified routes — the world’s undersea network faces escalating risks, threatening the seamless connectivity upon which modern society depends.

A recent Hacker News discussion has reignited debate over passkeys, the password‑less authentication method gaining traction across the web. The controversy stems from a post titled "Passkeys are a trap. Do not use them," which argues that the technology could be co‑opted to enforce restrictive attestation requirements. While the post has been widely shared, experts say its warnings do not reflect how passkeys currently operate.

The core claim in the post is that passkeys support attestation — a cryptographic proof that a website can request about the originating device. The author frames this as a "hidden dial" that could eventually force users to rely only on approved software and operating systems, eliminating alternatives such as custom firmware or open‑source platforms. The argument also invokes unrelated topics, including uBlock Origin, the FIDO Alliance membership list and UK image‑scanning proposals, to suggest that passkeys are inherently anti‑user.

In practice, most consumer passkeys — those synced through iCloud Keychain, Google Password Manager, 1Password, Bitwarden or similar services — do not transmit any attestation data to websites. Because these passkeys are stored locally on the user’s device, a site that attempts to require attestation would instantly lock out the vast majority of its own users, an outcome that would be counterproductive for any service provider. Industry guidance for consumer sites has therefore discouraged the use of attestation for everyday logins.

When attestation is present, WebAuthn records the make and model of the authenticator via an AAGUID and a vendor‑issued certificate. The information is limited to the hardware’s identity; it does not reveal the operating system, browser, extensions, firmware version or any other environmental detail. Consequently, the notion that attestation can enforce a blanket policy about a user’s software stack is inaccurate.

The post’s recommendation to switch to hardware keys such as YubiKey is ironic, because those very keys are the primary source of attestation. YubiKeys ship with vendor‑issued certificates that enable exactly the kind of attestation the author claims to fear. While YubiKeys remain a solid choice for high‑security scenarios, their use does not avoid attestation — it embraces it.

The article also critiques the suggestion to revert to Time‑Based One‑Time Passwords (TOTP). Although TOTP is more secure than static passwords, it remains vulnerable to phishing attacks. Recent incidents, such as those involving the Evilginx phishing framework, demonstrate how attackers can capture both a password and its accompanying TOTP code and replay them in real time. Passkeys mitigate this risk because they are bound to the specific domain for which they were created; a passkey generated for example.com cannot be reused on examp1e.com, eliminating the possibility of domain‑confusion attacks.

Given these technical realities, security researchers advise continued adoption of passkeys where available. Users should store them in trusted password or passkey managers and remain vigilant about emerging policy debates around attestation. While pushing back against potential misuse of attestation is important, abandoning passkeys today offers no protective benefit and only exposes accounts to greater phishing risk.

The discussion underscores a broader need for clear, evidence‑based communication about emerging authentication technologies. As passkeys become more ubiquitous, distinguishing between genuine security concerns and speculative threats will be essential for users, developers and policymakers alike.