View Ridge Security
Back to Cyber Hose

Arista patches actively exploited VeloCloud Orchestrator zero-day

Arista urges immediate patching of a critical zero-day in VeloCloud Orchestrator exploited in the wild, affecting SD-WAN management.

🚨 ACTIVE EXPLOITATION

  • Arista patches actively exploited VeloCloud Orchestrator zero-day CVE-2026-93952 (CVSS 10)
    Arista has released urgent patches for a critical, actively exploited zero-day in on-premises VeloCloud Orchestrator.
    • Affects only VeloCloud Orchestrator On-Prem (formerly VeloCloud Orchestrator by Broadcom), the central management tool for Arista VeloCloud SD-WAN.
    • CVE-2026-93952 (CVSS 10) is an improper input validation flaw letting remote attackers access privileged internal functionality, impacting confidentiality, integrity, and availability.
    • VCO is exposed when certificate-based authentication from VeloCloud Edge is configured; the attack requires network access to the VCO web interface but no tenant or operator credentials.
    • Fixed in VCO versions 5.2.3.16 and 6.4.2.8; no definitive IOCs exist, though Arista recommends reviewing VCO web access, backend, and system logs.
    • The flaw was added to CISA's Known Exploited Vulnerabilities list, giving federal agencies three days to patch under BOD 26-04.
    Sources πŸ“Ž Coverage: securityweek.com Β· πŸ‘ via SecurityWeek

πŸ•΅οΈ RESEARCH & DEEP DIVES

  • Malware in Terraform providers and Go modules turned dev tools into attack paths
    Malware linked to Graphalgo was planted in malicious Terraform providers and Go packages to reach developer machines.

    • Targets Terraform and Go developers building cloud infrastructure; Aikido says this is the first observed malware distribution via Terraform providers.
    • Malicious providers gocommunity-io/dockerd and typosquat kreuzwenker/docker (mimicking a Docker provider with 56M downloads) plus Go modules gocommunity.io/orderedbtree and gogets.dev/btreex.
    • Hidden code activates only when Terraform input values produce a specific hash, then decrypts and runs a Go payload from a disguised archive.
    • Second stage reports via Slack and receives commands through Slack or an Ethereum testnet smart contract; 18 distinct hostnames checked in (3 Windows, 5 Linux, 10 Macs).
    • IOCs include SHA-256 hashes of import-resource.sqlite3 and btreex.sql, domains gocommunity[.]io and gogets[.]dev, contract 0xAD02b5cDE693529d3bdA0266299501ad0193036C, and Slack workspaces portfolio-devs, portfolio-testers, mediumstar.
    Sources πŸ“Ž Coverage: cybersecuritynews.com Β· πŸ‘ via Cyber Security News, cryptika.com (discovered)

  • Novel 'supplychain.local' Go worm found in MemTensor npm and PyPI MemoryOS packages
    A novel self-propagating Go supply chain worm dubbed supplychain.local was discovered in compromised MemTensor npm and PyPI MemoryOS packages.

    • Affects users of npm package @memtensor/memos-cloud-openclaw-plugin versions >=0.1.21 and PyPI package MemoryOS versions >=2.0.34, both previously benign packages that appear compromised.
    • The worm is a multiplatform Golang binary that self-propagates via direct package publishing and compromised GitHub Actions.
    • Malicious loaders wired into top-level package code execute a hidden platform-specific 'sckit' binary (ARM/x86, Windows/Linux/macOS) on any package invocation, not at install time.
    • The dropper passes a base64-encoded config blob containing campaign ID 'cloud-openclaw-semi-nuclear' and C2 domains on skyleen.fr infrastructure, and harvests NPM_TOKEN/NODE_AUTH_TOKEN from the environment.
    Sources πŸ“Ž Coverage: aikido.dev Β· πŸ‘ via aikido.dev (discovered)

  • StreamRat Android malware spread via fake streaming app ads targeting users in Spain
    A fake streaming app distributed through Meta ads delivered the StreamRat Android malware that gives attackers full remote control of infected phones.

    • Android users, primarily Spanish speakers in Spain, targeted by ads for a free TV streaming app; one campaign reached about 570,000 Meta users between June 11 and July 3, 2026 (ad reach, not infections).
    • StreamRat can capture passwords, watch screens, log keystrokes, and let operators remotely control devices, exposing banking apps, messages, and other sensitive accounts.
    • Delivery starts with social media ads linking to a site that checks for Android, then walks users through sideloading a dropper that becomes the default home screen and installs the main trojan.
    • The malware abuses Accessibility permissions for screen capture, keylogging, and remote taps, can hide behind a black screen or fake system update, and the dropper can request VPN access to disrupt other apps' connectivity.
    • IOCs include app samples 'StrΡαmTV Pro' (io.base.one887) and 'Sistema de vΓ­deo' (io.meat.hint), C2 IPs 45.147.28[.]59 and 193.32.2[.]245, and payload files like app.apk and update_{timestamp}.apk.
    Sources πŸ“„ Source: zimperium.com Β· πŸ“Ž Coverage: cybersecuritynews.com Β· πŸ‘ via Cyber Security News, cryptika.com (discovered)

πŸ”“ CVEs & KEV

  • CVE-2026-74849 β€” Zohocorp ManageEngine ADSelfService Plus β€” CVSS 9.8 β€” Critical ManageEngine Flaw Lets Attackers Gain SYSTEM Access Through Windows Login Screen

  • CVE-2026-91800 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 8.8 β€” Foxit PDF Editor installer local privilege escalationA local privilege escala...

  • CVE-2026-91798 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 8.8 β€” Foxit PDF Editor/Reader Updater Privilege EscalationA local privilege escalat...

  • CVE-2026-91803 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 8.8 β€” Security Vulnerability Report – Foxit PDF Editor/Reader Updater DLL Search Pa...

  • CVE-2026-91790 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 7.8 β€” Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vuln...

  • CVE-2026-91791 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 7.8 β€” Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulne...

  • CVE-2026-91792 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 7.8 β€” Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulne...

  • CVE-2026-91793 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 7.8 β€” Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vuln...

  • CVE-2026-91794 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 7.8 β€” Foxit PDF Editor/Reader DeviceN Colorspace Out-Of-Bounds Write Remote Code Ex...

  • CVE-2026-91795 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 7.8 β€” Foxit PDF Editor/Reader FileOpen Uninitialized Variable Remote Code Execution...

  • CVE-2026-91797 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 7.8 β€” Foxit PDF Editor/Reader Portfolio Directory Traversal Remote Code Execution V...

  • CVE-2026-91799 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 7.8 β€” Foxit Editor/Reader Array resetForm Use-After-Free VulnerabilityA use-after-f...

  • CVE-2026-91805 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 7.8 β€” Use-after-free Vulnerability in Foxit PDF Editor/Reader Page-tree HandlingA u...

  • CVE-2026-91801 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 7.8 β€” Foxit PDF Editor/Reader RichMedia Annotation Directory Traversal Remote Code ...

  • CVE-2026-91802 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 7.8 β€” Foxit PDF Editor/Reader β€” Heap Buffer Overflow in WebP Image Decoding via Bit...

  • CVE-2026-91804 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 7.8 β€” Foxit PDF Editor/Reader Out-of-bounds Write Vulnerability While RenderingA he...

  • CVE-2026-91806 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 7.8 β€” Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vuln...

  • CVE-2026-91796 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 6.1 β€” Foxit PDF Editor/Reader importIcon NTLM Response Information Disclosure Vulne...

  • CVE-2026-91807 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 6.1 β€” Foxit PDF Editor/Reader PDF File Parsing Out-Of-Bounds Read Information Discl...

  • CVE-2026-91808 β€” Foxit Software Inc. Foxit PDF Editor β€” CVSS 6.1 β€” Foxit PDF Editor/Reader JPEG File Parsing Out-Of-Bounds Read Information Disc...

πŸ“‹ ADVISORIES

  • πŸ“„ Source

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check