Overview of incoming advisories.
2018 results found
Security researchers at Imperva have demonstrated a remote code execution exploit called 'Node2Shell' targeting a vulnerability in Node.js's bundled Brotli decoder. The proof of concept successfully ran attacker-supplied code on the official Node.js 24.22.0 image for Linux arm64 without requiring a debugger or custom build. The attack works by feeding specially crafted Brotli data to the bundled Brotli decoder component. The vulnerability is tracked as CVE-2026-111497 and was disclosed by Node.js. The exploit requires no special configuration, making it particularly dangerous for any application running on an official Node.js build that processes Brotli-compressed data. The demonstration highlights a significant risk for production environments using standard Node.js deployments.
View original advisory →Threat actors are actively attempting to exploit two newly disclosed PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS score of 9.2. The attacks aim to leverage unauthenticated remote code execution to compromise systems and enlist them into a Mirai botnet variant called Potassium. Despite the high volume of exploit attempts reaching millions, attackers have been largely unsuccessful, as weaponizing the flaws appears more difficult than initially anticipated. The vulnerabilities allow unauthenticated remote access, making them high-severity targets for botnet operators. The Mirai-based Potassium variant is the end payload intended for deployment on compromised systems. This campaign highlights the rapid exploitation attempts that follow public disclosure of critical vulnerabilities.
View original advisory →Collabora Online's Built-in CODE Server contains an OS command injection vulnerability when used within the Nextcloud platform. The flaw allows remote code execution when the CODE server is not running. The vulnerability affects the integration between Collabora Online and Nextcloud, posing significant risk to users of this combination. CISA has flagged this under BOD 26-04, requiring prioritized security updates. Users are urged to update their Collabora Built-in CODE Server as soon as possible. The advisory is backed by both GitHub security advisories and NVD documentation. Forensics triage requirements have also been outlined under BOD 26-04 implementation guidance.
View original advisory →A SQL injection vulnerability has been identified in Arista VeloCloud Orchestrator (VCO) on-premises deployments. The flaw allows a remote attacker to access privileged internal functionality without proper authorization. Successful exploitation can compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages. The vulnerability is tracked as CVE-2026-114625 and has been listed by CISA. Arista has published a security advisory with remediation guidance. The issue is subject to CISA's BOD 26-04 directive, which mandates prioritizing security updates based on risk. Organizations running on-prem VeloCloud Orchestrator instances are urged to apply patches immediately. The vulnerability poses significant risk to network management infrastructure given VCO's role in orchestrating SD-WAN environments.
View original advisory →Elastic Security Labs analyzed CVE-2026-73570, a command injection vulnerability in Zimbra that can be exploited to achieve remote code execution. Researchers reproduced the vulnerability and discovered that several publicly available proof-of-concept (PoC) exploits are flawed, writing payloads that Swatchdog never matches. This means a failed exploit attempt may incorrectly appear as though the server is patched, leading to false confidence in security posture. The attack vector involves the manipulation of Zimbra log files, which are processed by Swatchdog, a log monitoring utility. The article provides technical detail on how the exploit chain works and highlights the pitfalls in existing public PoCs. Organizations running Zimbra should treat this as a high-severity issue requiring immediate patching and validation.
View original advisory →Japanese gaming company Capcom has confirmed a data breach affecting its CAPCOM ID membership service. The breach exposed over 11.7 million customer email addresses along with associated personal information. The incident involved unauthorized access by hackers to Capcom's membership platform. This is a significant breach given the large number of affected users. The breach impacts customers who had registered accounts with CAPCOM ID. Capcom has publicly disclosed the incident following investigation. The exposed data includes at minimum email addresses and potentially other account-related information. This breach raises concerns about the security of gaming platform user data.
View original advisory →eMudhra's emSign intermediate Certificate Authority keys were compromised, putting Python package downloads and CI/CD pipelines at significant risk. The compromise affects tools like pip and uv that rely on certificate trust chains for secure dependency downloads. Users of Python virtual environments and CI/CD images that bundle affected certificates need to take immediate action. The article provides details on which tools and environments are affected, along with verified certificate-trust test results. Remediation steps are provided for pip, uv, virtual environments, and CI/CD images to remove or distrust the compromised certificates. This is a supply chain security issue with broad implications for Python developers and DevOps engineers worldwide.
View original advisory →Hackers compromised the LiteLLM project's release pipeline, resulting in the publication of malicious PyPI packages and Docker images. The malicious payload was designed to steal credentials, secrets, and environment variables from affected systems. LiteLLM is a popular open-source library used to interact with large language model APIs, making this a significant supply chain attack targeting AI/ML developers. The attack involved tampering with the CI/CD pipeline to inject malicious code into legitimate release artifacts. Victims who installed the compromised package or pulled the malicious Docker images would have had sensitive data exfiltrated. This incident highlights the growing risk of supply chain attacks targeting AI tooling ecosystems.
View original advisory →Arista has issued an advisory warning of an actively exploited zero-day SQL injection vulnerability in its VeloCloud Orchestrator (VCO), the central management platform for VeloCloud SD-WAN networks. The flaw allows any authenticated user, even those with read-only customer accounts, to escalate privileges to operator level, the highest control tier. The advisory was published on October 22. No CVE identifier is mentioned in the available content. The vulnerability poses significant risk to organizations relying on VeloCloud SD-WAN infrastructure for network management. Active exploitation has been confirmed, making this a critical and urgent issue for affected deployments.
View original advisory →This weekly cybersecurity roundup covers a wide range of critical security incidents and vulnerabilities. Highlights include critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. Additional issues include AI secrets leakage, source code theft targeting PingCAP, a Signal application hang-up flaw, and a Laravel authentication bypass vulnerability. The article also references stolen passwords and other exposed credentials. In total, the roundup covers 25 or more distinct cybersecurity threats and incidents from the week, spanning multiple platforms, services, and vulnerability types.
View original advisory →Arista Networks has released security updates to address an actively exploited zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments. The vulnerability is being exploited in the wild, making it a high-priority patching concern for organizations running on-premises VCO installations. Arista has responded by issuing patches to mitigate the risk. The article highlights the urgency for administrators to apply the updates immediately given the active exploitation. VeloCloud Orchestrator is a network management platform used in SD-WAN environments, making this a significant concern for enterprise network infrastructure.
View original advisory →Eight eMudhra intermediate Certificate Authority (CA) private keys were found to be compromised, posing significant risks to TLS certificate integrity. The compromise enables threat actors to perform unauthorized TLS certificate signing and man-in-the-middle (MitM) interception attacks. eMudhra is a licensed Certifying Authority, making this a high-impact PKI trust chain issue. Unit 42 published an analysis of the compromise along with a containment guide for affected organizations. The exposure of intermediate CA private keys can allow attackers to impersonate any domain covered under the affected CA hierarchy. This type of compromise undermines the foundational trust model of HTTPS and certificate-based authentication. Organizations relying on eMudhra-issued certificates are advised to review and revoke affected certificates immediately.
View original advisory →Two remote code execution vulnerabilities in Linux's built-in SMB server (KSMBD) have been publicly disclosed on mailing lists before mainline kernel patches are available. Both flaws carry a CVSS score of 9.0 and were reported by Trend Micro's Zero Day Initiative. ZDI-CAN-33774 is particularly dangerous as it can be triggered pre-authentication over the network. ZDI-CAN-33549 requires SMB Direct transport and an RDMA-capable network interface. Linux servers with KSMBD enabled are currently exposed with no official fix in the mainline kernel. The public disclosure before patching increases the risk of exploitation by threat actors.
View original advisory →INTERPOL announced the results of Operation Serengeti III, a coordinated global law enforcement action conducted between June 29 and August 31, 2026. The operation successfully disrupted 10,909 malicious cybercrime networks and recovered more than $105 million in illicit funds. Law enforcement agencies from 21 countries participated in the crackdown, resulting in the arrest of 1,462 suspects. This represents the third iteration of the Serengeti operation, reflecting ongoing international cooperation against cybercrime. The scale of disruptions and arrests underscores the growing effectiveness of multinational law enforcement collaboration in combating cyber threats.
View original advisory →Amazon Threat Intelligence researchers discovered that attackers began exploiting PHP2Shell vulnerabilities four days before security patches were made available. The exploitation predates the official patch release, indicating a zero-day or near-zero-day attack window. Amazon was involved in tracking and reporting this threat activity. The article highlights the risk of pre-patch exploitation, where threat actors may have had prior knowledge of the vulnerabilities. This type of activity underscores the importance of rapid patch deployment and proactive threat monitoring. The PHP2Shell flaws were patched on a Wednesday, meaning exploitation began the preceding Saturday. The early exploitation window could have allowed attackers significant time to compromise systems before defenders had any mitigation available.
View original advisory →Wiz Research is tracking a threat actor overlapping with Storm-0940 that uses an AI-powered attack tool called ARTEX to target multiple software and IT vendors. The campaign focuses on identity providers and cloud authentication platforms including Okta, Microsoft Entra, and AWS Cognito. ARTEX functions as an AI agent capable of conducting automated attacks against identity and access management systems. The actor has expanded its targeting scope to include software vendors beyond its previously known victims. Forensic artifacts and log evidence were left behind during the intrusions, providing visibility into the attack methodology. This represents a notable escalation in the use of AI-assisted tooling by a state-linked threat actor in enterprise cloud environments.
View original advisory →GitLab has released security patches addressing a maximum-severity vulnerability in its Regular Expression Compiler component. The flaw allows remote attackers to execute arbitrary code on vulnerable GitLab servers without authentication. The vulnerability has been assigned the highest possible severity rating, indicating significant risk to organizations running unpatched GitLab instances. GitLab has urged administrators to apply the patches immediately. The issue affects GitLab's server-side processing and could be exploited remotely, making it a critical threat to DevOps pipelines and source code repositories hosted on GitLab infrastructure.
View original advisory →The litellm 1.107.0 package on PyPI was compromised with malicious code embedded in its wheels and Docker images. The attack introduced a .pth file-based credential stealer that activates on Python startup. An hourly remote code loader was also included, periodically fetching and executing code from litellm.dev. The malware exfiltrates credentials and sensitive data to an attacker-controlled domain. This is a supply chain attack targeting AI/LLM developers using the popular litellm library. The article provides indicators of compromise (IOCs) and remediation guidance for affected users.
View original advisory →Oracle has patched multiple vulnerabilities across several Fusion Middleware products including WebLogic Server, SOA Suite, Data Integrator, Identity Manager, Access Manager, WebCenter Content, Helidon, and HTTP Server. Vulnerabilities include unsafe deserialization, insufficient authentication and access controls, flaws in network protocols (HTTP, HTTP/2, SOAP, T3, IIOP, LDAP), and cryptographic library issues in Bouncy Castle and Jackson-databind. Attackers can exploit these to achieve arbitrary code execution, full system compromise, unauthorized data access, data manipulation, denial-of-service, privilege escalation, cross-site scripting, and spoofing. Exploitation is possible via network access, often without authentication, with some cases requiring user interaction. CVSS scores reach up to 10.0, indicating maximum severity. No proof-of-concept code is currently known, but NCSC anticipates increased scanning and exploitation activity due to the wide deployment of these products.
View original advisory →On October 21, 2026, LiteLLM's release pipeline was compromised, resulting in a malicious version (1.107.0) being pushed to both Docker Hub and PyPI. Threat actors bypassed multiple independent security controls to inject a credential stealer and backdoor into the package. LiteLLM suspects that a GitHub token leaked via AI gateway logs may have been the initial attack vector. The incident occurred around 4:00 a.m. and represents a significant supply chain attack targeting AI/ML tooling infrastructure. Users who downloaded or used the compromised version may have had credentials stolen or systems backdoored.
View original advisory →