Today's outlook

Arista VeloCloud Orchestrator zero-day under active attack; PHP ships emergency RCE patches

By The IT Security Desk

Good morning. The Hacker News reports that attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, per an Arista advisory dated October 22. The Hacker News says the flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges. BleepingComputer reports Arista released security updates to patch the actively exploited zero-day affecting VeloCloud Orchestrator On-Prem deployments. Follow the Arista advisory for the fixed build.

Schneier on Security reports that PHP maintainers released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities that can allow unauthenticated remote code execution, and that all PHP users are strongly encouraged to update immediately. Schneier lists the at-risk group as all PHP installations serving web requests. The Register reports a PHP2Shell exploit that bypasses protections designed to stop remote code execution.

Google's advisory lists six vulnerabilities in Chrome — CVE-2026-113342, CVE-2026-113336, CVE-2026-113328, CVE-2026-113300, CVE-2026-113283 and CVE-2026-113270 — affecting Chrome up to the fix in 156.0.8078.47, each carrying the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base score 9.6. Follow Google's advisory for the fixed release: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

Help Net Security reports a malicious LiteLLM release pushed to PyPI and Docker registries on Wednesday, built to harvest cloud logins, developer secrets and API keys for AI services from anyone who installed it; it quotes researcher Kevin Beaumont on Mastodon, "LiteLLM got compromised… again," and calls it the second supply-chain attack this year. BleepingComputer reports the payload steals credentials, secrets and environment variables. Help Net Security says users should rotate credentials.

The Hacker News reports that eMudhra's board decided on Thursday to withdraw from its global SSL/TLS certificate business, five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates; The Record reports researcher Scott Helme published a blog saying one private key was just the number four. The Hacker News reports eMudhra will replace affected customers' certificates.

CISA reports it added six new vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. BleepingComputer reports Capcom confirmed a breach of its CAPCOM ID membership service exposing more than 11.7 million customer email addresses and associated information, reports that Railway warned users to rotate secrets after detecting suspicious activity on systems storing customer environment variables, and The Record reports the Toronto chapter of Crime Stoppers paused operations after a data breach.