🚨 ACTIVE EXPLOITATION
Arista patches third exploited VeloCloud Orchestrator zero-day in four months (CVE-2026-114625)
Arista has patched CVE-2026-114625, a critical SQL injection zero-day in on-premises VeloCloud Orchestrator that is being actively exploited.- Affects on-premises Arista VeloCloud Orchestrator (VCO), the centralized management tool for VeloCloud SD-WAN; all releases before 5.2.3.18, 6.1.3.10, and 6.4.2.12 are vulnerable; hosted deployments are already patched.
- CVE-2026-114625 (CVSS 9.9) is a remotely exploitable SQL injection letting any authenticated user gain operator privileges, masquerade as a local 'superuser operator', and access internal-only functionality.
- Exploitation requires access to the VCO web interface and a valid authenticated session with the lowest built-in tenant role privileges; VCO deployments are exposed by default and no configuration prevents exposure.
- Attacks have been observed from IP addresses 74.82.197.86 and 38.54.50.151; Arista advises checking logs for these IPs, high request rates, unusual URL-like paths, encoded characters, and internal service references.
- This is the third exploited VCO zero-day patched in four months, following CVE-2026-16812 in July and CVE-2026-93952 in September.
PHP2Shell exploit attempts surge as attackers fail to weaponize the PHP RCE flaws
Attackers have made millions of unsuccessful PHP2Shell exploitation attempts, including attempts to deploy the Mirai-derived Potassium botnet.- Applies to servers running PHP; every version since 5.4 is affected by at least one of the two flaws, powering WordPress, Drupal, Joomla and most of the web.
- CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) enable unauthenticated RCE and memory disclosure via crafted HTTP requests; patched in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Sophos observed attempts to install a Mirai-derived botnet called Potassium, which resolves C2 domain thunder.godofthunder[.]st to 134.199.154[.]64 on TCP port 50792 to launch DDoS floods against hosts in a Ukrainian network.
- Attack sources included 85.11.167[.]243, 217.60.242[.]76 and 45.198.224[.]169, which contacted 92.118.112[.]100 to fetch the loader; many GitHub exploits fail because attackers cannot defeat ASLR.
- SOCRadar found a 'one-click' exploit toolset (aslr_exploit.py targeting PHP 8.4.26 under Apache mod_php) on 206.188.197[.]105, screening sites across seven countries, with no evidence of successful compromise.
Sources 📄 Source: sophos.com · 📎 Coverage: thehackernews.com · 👁 via The Hacker News, @GossiTheDog@cyberplace.social (+2)
💥 BREACHES & INCIDENTS
LiteLLM hit again by supply chain attack using stolen GitHub CLI OAuth tokens
LiteLLM's PyPI and Docker packages were compromised in a supply chain attack that delivered a credential-stealing backdoor to users of version 1.107.0.- Users of the open source LiteLLM LLM proxy, especially version 1.107.0 on PyPI and Docker Hub, were exposed; enterprise customers on the private repository were not affected
- The malicious packages ran a credential stealer at Python startup and acted as a RAT, harvesting browser credentials, cloud secrets (AWS, GCP, Azure), AI API keys (Anthropic, Copilot, OpenAI), SSH keys and environment variables
- Attackers used exposed GitHub CLI OAuth tokens likely leaked via Claude Code into LiteLLM logs, then disabled branch protections and published poisoned artifacts from a lookalike repository
- Stolen data was encrypted and sent to litellm[.]dev; Wiz observed attackers using stolen AWS credentials against Amazon Bedrock in possible LLMjacking
- Packages were live about three hours on October 21, downloaded over 49,000 times; the last clean version is 1.106.2
Capcom breach exposes 11.77 million Capcom ID email addresses, passwords reset for 196 accounts
Capcom disclosed a data breach exposing the email addresses of 11.77 million Capcom ID accounts.- Affects Capcom ID users — the free account required for online features of games like Street Fighter 6
- Attackers stole email addresses of 11,774,247 people plus account metadata: creation date, last login date, login count, and last login IP address
- For 43 users, dates of birth, gender, country/region, and nicknames were also compromised
- Attackers changed the passwords of 196 accounts without authorization; Capcom has reset them; user-created passwords and credit card details were not compromised
- The breach was discovered October 19; Capcom reported it to Osaka Prefectural Police and Japan's Personal Information Protection Commission and warns of phishing emails impersonating the company
eMudhra exits SSL/TLS certificate business after issuing intermediates with 3-8 bit private keys
eMudhra is exiting its global SSL/TLS certificate business following the discovery of eight intermediate certificates with trivially crackable private keys.- Affects all major browsers, email servers, IoT devices, Docker containers, and other systems trusting eMudhra's G3 root intermediates, including sites like India's tax portal
- Eight intermediate certificates had private keys of only 3-8 bits of entropy (4, 56, 66, 115, 155, 156, 230, 237) instead of the expected ~384 bits for NIST P-384 ECC keys, crackable in milliseconds
- A flaw in the April 30, 2025 Key Generation Ceremony script caused a wrap/unwrap step on FIPS 140-2 Level 3 HSMs to produce a second set of weak keys, which were mistakenly used for the CSR due to similar key labels and cross-signed by Sectigo
- eMudhra revoked the certificates, stopped issuing under its G3 root, and browsers blocked the intermediates within days; the business generated only 1% of revenue
- CRLs were initially signed with the original keys, produced incorrect signatures, and were re-signed with the flawed keys
Low-Skill Hacker 'BUGSTER' Used DeepSeek AI to Breach Indian University, Steal 5,200 Records
A low-skilled hacker using DeepSeek AI tools breached Indian universities and stole a MongoDB database with over 5,200 records.- Actor 'BUGSTER' targeted Indian organizations including two universities, stealing a MongoDB database with 5,200+ student and staff records via an admin account with a weak password.
- Tooling combined Hermes Agent AI framework, DeepSeek V4 as reasoning model, and Cursor as a coding tool, with safety controls disabled.
- AI-assisted research mapped a university's WordPress site, learning platform, student portal and admin dashboard, enabling password guessing that found one working login.
- Other activity included credential-scanning for exposed cloud/private keys, Wi-Fi password cracking requiring local access, VoIP fraud planning, and cryptocurrency holder research.
- IOCs: IP 162.243.3[.]92 (actor infrastructure) and 104.238.38[.]202 (commercial proxy server).
🔓 CVEs & KEV
- CVE-2026-112900 — python-pillow Pillow — CVSS 9.2 — Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
📋 ADVISORIES
Atlassian October 2026 Bulletin Patches 75 Third-Party Flaws Across Data Center and Server Products
Atlassian's October 2026 security bulletin discloses 75 unique third-party vulnerabilities, including six critical ones, across its Data Center and Server products.- Affects Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management Data Center and Server products.
- Bulletin lists 176 vulnerability entries: 162 high-severity and 14 critical-severity, all tied to third-party dependencies; SecurityWeek counts 75 unique CVEs.
- Critical flaws include CVE-2026-65637, CVE-2026-65182, CVE-2026-68525 (Apache Tomcat), CVE-2026-58062 (Bouncy Castle), CVE-2026-75595 (Netty), and CVE-2026-77185 (Apache SSHD).
- Atlassian assesses its use of the affected components as presenting lower, non-critical risk; no exploitation has been reported.
- Issues span DoS, cryptographic failures, broken authentication, SSRF, information disclosure, and code execution in libraries like Tomcat, Netty, Bouncy Castle, Jackson, Axios, Spring, Struts, and ActiveMQ.
📄 Source for Imperva's Node2Shell PoC Achieves RCE on Official Node.js Build via Crafted Brotli Data (CVE-2026-111497) — imperva.com