AI is no longer merely writing phishing emails. It is probing networks, exploiting access and directing intrusions at scale. As investigations expose both malicious agents and runaway security tools, businesses face a defining question: who controls the software acting on their behalf in real time?
IBM survived Washington and still lost the layer that mattered. Wall Street now fears the same fate for AI: the Nasdaq in correction, Seoul halting trades, CoreWeave’s default insurance at a record. Congress may not stop the race. Whoever controls the power, chips and credit may decide it instead.
Wall Street’s post-election relief gave way to a sharp AI sell-off last night, as investors weighed construction delays, borrowing costs and political scrutiny. With chipmakers leading the losses, the question is becoming more urgent: which businesses can afford to wait for the promised returns?
Ivanti has confirmed actively exploited, pre‑authentication remote code‑execution flaws in its Endpoint Manager Mobile platform, allowing attackers to hijack internet‑facing MDM servers, push malicious device profiles, and exfiltrate sensitive mobile data at enterprise scale
Cyber News Centre's cyber update for 2nd February 2026: Ivanti has disclosed two critical zero-day vulnerabilities in its Endpoint Manager Mobile (EPMM) software, which are under active attack.
Ivanti is a US-based IT software company that provides solutions for IT security, service management, and unified endpoint management. Its EPMM platform is a mobile device management (MDM) solution used by enterprises worldwide to secure and manage corporate and user-owned mobile devices.
Update: Ivanti has released emergency patches for two critical zero-day vulnerabilities, CVE-2026-1281 and CVE-2026-1340, affecting its Endpoint Manager Mobile (EPMM) software. Both flaws are code injection vulnerabilities that allow unauthenticated attackers to execute arbitrary code remotely. With a CVSS score of 9.8, the vulnerabilities pose a significant threat to organisations that use EPMM to manage their mobile device fleets.
The company has confirmed that a "very limited number" of customers have been exploited. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-1281 to its Known Exploited Vulnerabilities (KEV) catalog, mandating that U.S. federal agencies patch the flaw by February 1, 2026.
The flaws stem from Ivanti’s In‑House Application Distribution and Android File Transfer Configuration features, where crafted requests can unlock a rich seam of sensitive data; from admin and user credentials to phone numbers, IP addresses and unique device identifiers across the managed fleet.
Once in, attackers are not just reading data but effectively inheriting the keys to the MDM kingdom, with the ability to push configuration changes that can weaken protections or seed malicious profiles across thousands of devices in one hit.
Ivanti has rushed out temporary RPM scripts as a stop‑gap and says a full fix will land in version 12.8.0.0 later in Q1 2026, but the episode adds to a growing rap sheet: as CNC reported in 2024, the same vendor has already weathered major bugs in its Connect Secure and Policy Secure gateways, keeping the spotlight firmly on its hardening story.
Why it Matters: The exploitation of these zero-day vulnerabilities in Ivanti's EPMM software places thousands of organisations globally at immediate risk. As a widely used mobile device management (MDM) platform, EPMM is a gateway to sensitive corporate data and a critical component of enterprise security.
A compromise of the EPMM appliance could lead to widespread data breaches, lateral movement across corporate networks, and the deployment of malware on thousands of mobile devices. The fact that these vulnerabilities are being actively exploited in the wild elevates the threat level, requiring immediate action from all EPMM customers. The short patching deadline set by CISA underscores the severity of the situation.
This incident highlights the inherent risks in the software supply chain and the critical need for robust vulnerability management programs. The potential for attackers to gain access to both corporate and personal data on mobile devices makes this a significant threat to business operations and individual privacy.
Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.
AI is no longer merely writing phishing emails. It is probing networks, exploiting access and directing intrusions at scale. As investigations expose both malicious agents and runaway security tools, businesses face a defining question: who controls the software acting on their behalf in real time?
Binance’s US$6.3 billion theft exposes the fault line beneath crypto’s institutional ambitions: the authority to move money. With the FBI blaming North Korea and investigators tracing stolen assets, the breach raises urgent questions for custody, tokenisation and the future of automated finance.
AI is finding flaws faster than defenders can patch them, while autonomous agents push past human instructions. From exposed government systems to an Anthropic model that ignored stop signs, the question is who can halt the machine—and who pays when it acts without permission or moves the money.
OpenAI’s Medicare breach has shifted Australia’s AI debate from investment to accountability. As Canberra examines legal options and calls grow for stronger sovereign capability, the question is global: who controls autonomous systems, and who answers when they cross national boundaries?
Where cybersecurity meets innovation, the CNC team delivers AI and tech breakthroughs for our digital future. We analyze incidents, data, and insights to keep you informed, secure, and ahead. Sign up for free!
