Daily Briefing

CISA flags actively exploited Arista VeloCloud SQL injection as PHP warns of an unpatched 9.8 RCE

By The IT Security Desk

Good morning. CISA added an Arista VeloCloud Orchestrator SQL injection vulnerability to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, according to CISA. CISA's alert states that Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritise rapid remediation of CVEs listed in the KEV Catalog. If you run VeloCloud Orchestrator, treat this as the day's priority: apply the vendor's fix and check for exploitation.

BleepingComputer reports the PHP security team has shared mitigation measures for a new remote code execution vulnerability that has no patch and affects systems with non-default configurations. The advisory record lists this as CVE-2026-109618 with a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 9.8. With no fixed release available, follow the mitigation in PHP's advisory (https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w).

Google's Chrome stable channel update fixes five flaws — CVE-2026-113342, CVE-2026-113336, CVE-2026-113328, CVE-2026-113300 and CVE-2026-113283 — each carrying the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H and a base score of 9.6, per the advisory record. Google's advisory lists the fix in version 156.0.8078.47 (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html). Update Chrome and restart the browser.

Read the full briefing →

Zoom out: Three separate reports on the day — the edge-device credential campaign, the Microsoft 365 session-replay intrusions and the Phantom affiliate framework — all turned on stolen access and automation rather than a single novel exploit.

Vulnerability in focus

CVE-2026-109618 — Php. CVSS 9.8

Affected: panos.

What to do: Follow the vendor advisory for the fixed release and any interim mitigation.

Elsewhere

BleepingComputer: Abandoned Popcorn Time app exposed millions of device to RCE attacks Read it
The Register: Red-team report found OpenAI utterly failed to monitor its agents during Hugging Face attack Read it
The Hacker News: BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations Read it
CISA: CISA Adds One Known Exploited Vulnerability to Catalog Read it
The Hacker News: Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws Read it
The Record: FCC bans two devices with surveillance chips linked to Huawei Read it
BleepingComputer: PHP shares mitigation for new RCE vulnerability with no patch Read it
The Record: UK proposes 14-year prison terms for undersea cable sabotage Read it
BleepingComputer: HPE patches eight max severity RCE and auth bypass AOS flaws Read it
The Hacker News: URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches Read it
The Register: Torvalds: AI is fine for competent devs, but spare us the 'drive-by' patches Read it
Schneier on Security: Compromised TLS Certificates Read it

Sources

Abandoned Popcorn Time app exposed millions of device to RCE attacks BleepingComputer
Red-team report found OpenAI utterly failed to monitor its agents during Hugging Face attack The Register
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations The Hacker News
FCC bans two devices with surveillance chips linked to Huawei The Record
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware SecurityWeek
CISA Adds One Known Exploited Vulnerability to Catalog CISA
Microsoft 365 accounts compromised at 79 organizations, no passwords needed Help Net Security
Compromised TLS Certificates Schneier on Security
Microsoft Teams to get AI-powered, context-aware phishing detection BleepingComputer
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws The Hacker News
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions The Hacker News
Quest Diagnostics confirms data breach exposed patient records BleepingComputer
PHP shares mitigation for new RCE vulnerability with no patch BleepingComputer
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials The Hacker News

Share this issue

Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky

Every briefing is on the site, with the advisory record behind it. All briefings