Ivanti Connect Secure zero-days now under mass exploitation

Multiple threat groups, including a suspected Chinese state–linked actor, have been chaining two zero‑day vulnerabilities in Ivanti Connect Secure and Policy Secure appliances to run arbitrary commands, deploy the GIFTEDVISITOR webshell and several custom malware families (ZIPLINE, Thinspool, Wirefire, Lightwire, Warpwire, etc.), and compromise thousands of VPN/NAC appliances worldwide; vendors have issued mitigations and administrators are advised to treat appliance data as compromised.