Attackers Exploit Critical Command Injection Flaw in Arista VeloCloud

🚨 ACTIVE EXPLOITATION

• Attackers Exploit Critical Command Injection Flaw in Arista VeloCloud Orchestrator CVE-2026-16812
  CVE-2026-16812 (CVSS 9) allows remote OS command injection leading to arbitrary code execution in Arista VeloCloud Orchestrator.

  • Applies to on-premises Arista VeloCloud Orchestrator versions prior to 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1
  • Attackers exploit a flaw in internal functionality exposed remotely, compromising orchestrator confidentiality, integrity, and availability
  • Indicators of compromise include three malicious IPs: 8.19.75.217, 206.72.242.124, and 206.72.242.162
  • U.S. CISA added the flaw to its Known Exploited Vulnerabilities catalog with patch deadline July 30, 2026
  Sources 📎 Coverage: thehackernews.com · 📄 Original: thehackernews.com · 👁 via The Hacker News

• CISA Warns of Active Exploitation of Fortinet FortiOS Vulnerability CVE-2025-68686 CVE-2025-68686
  CVE-2025-68686 in Fortinet FortiOS is actively exploited to expose sensitive information via symbolic link persistence bypass.

  • Affects Fortinet FortiOS used in FortiGate firewalls and other Fortinet products
  • Exploitation requires prior filesystem-level access from a separate vulnerability
  • Attackers send crafted HTTP requests to bypass patch protections for persistence
  • CISA added CVE-2025-68686 to Known Exploited Vulnerabilities catalog with active attacks confirmed
  Sources 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News

💥 BREACHES & INCIDENTS

• Origin Energy Data Breach Exposes Personal Data of 900,000 Australians
  Origin Energy suffered a data breach impacting 900,000 current and former customers.
  • Exposed data includes names, dates of birth, phone numbers, addresses, account info, and partial payment card or bank account numbers
  • Breach discovered in July 2026 after investigation of a potential security threat
  • Hacker claimed to have stolen data of 2 million customers and threatened to leak it unless paid ransom
  • Origin Energy has not confirmed any ransom payment; authorities are investigating
  Sources 📎 Coverage: securityweek.com · 👁 via SecurityWeek

🕵️ RESEARCH & DEEP DIVES

• Operation STANDOFF Uses GitHub Redirects to Mask Russian Cybercrime Campaign
  Operation STANDOFF is a Russian cybercrime campaign delivering multiple malware via GitHub redirects.

  • Targets include individual and enterprise systems infected via pay-per-install loaders
  • Delivers info stealers, loaders, cryptocurrency miner, and botnet components in one package
  • Uses HTTP 301 redirects to GitHub to hide command-and-control traffic and evade detection
  • Employs gaming-themed lures and automated outreach to spread malware
  • Operators use stolen credentials and proxy botnet for deeper network intrusion and traffic relay
  Sources 📎 Coverage: cybersecuritynews.com · 📄 Original: cybersecuritynews.com · 👁 via Cyber Security News

• DCSync Attack Enables Silent Theft of Active Directory Password Hashes
  DCSync attacks let adversaries steal Active Directory password hashes without touching domain controllers directly.

  • Applies to enterprises using Active Directory with replication rights assigned
  • Attack targets password hashes of users, services, and machines via replication protocol
  • Works by impersonating a domain controller and requesting secrets over MS-DRSR RPC
  • Requires DS-Replication-Get-Changes and DS-Replication-Get-Changes-All rights, often held by privileged or misconfigured accounts
  • Commonly executed using tools like Mimikatz's lsadump::dcsync module
  Sources 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News

🔓 CVEs & KEV

• CVE-2026-17524 — CVSS 7.5 — Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal
• CVE-2026-17528 — CVSS 6.1 — Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting