Today's outlook

CISA flags actively exploited Arista VeloCloud SQL injection as PHP warns of an unpatched 9.8 RCE

By The IT Security Desk

Good morning. CISA added an Arista VeloCloud Orchestrator SQL injection vulnerability to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, according to CISA. CISA's alert states that Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritise rapid remediation of CVEs listed in the KEV Catalog. If you run VeloCloud Orchestrator, treat this as the day's priority: apply the vendor's fix and check for exploitation.

BleepingComputer reports the PHP security team has shared mitigation measures for a new remote code execution vulnerability that has no patch and affects systems with non-default configurations. The advisory record lists this as CVE-2026-109618 with a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 9.8. With no fixed release available, follow the mitigation in PHP's advisory (https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w).

Google's Chrome stable channel update fixes five flaws — CVE-2026-113342, CVE-2026-113336, CVE-2026-113328, CVE-2026-113300 and CVE-2026-113283 — each carrying the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H and a base score of 9.6, per the advisory record. Google's advisory lists the fix in version 156.0.8078.47 (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html). Update Chrome and restart the browser.

The Hacker News reports Ruby released versions 4.0.9, 3.4.12 and 3.3.13 to fix three bugs in the Onigmo regular expression engine that lie behind four critical security flaws GitLab patched over the past month. Patch Ruby and GitLab accordingly.

The Hacker News also reports a large-scale campaign against exposed network edge devices including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, exposing over 70,000 credentials. Help Net Security reports that, according to Huntress, an attacker replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organisations between July 14 and September 22, 2026, using hidden inbox rules to hide mail from victims. Review edge-device exposure and Microsoft 365 inbox rules and sessions.

In further reporting: BleepingComputer says Quest Diagnostics confirmed patient records were exposed after a threat actor accessed its Quanum LSM system. The Hacker News reports a UEFI bootkit called BlackX that bypasses Secure Boot on patched Windows systems missing revocations, with activity against diplomatic entities in Tajikistan, Uzbekistan and Turkmenistan in early 2026 that The Hacker News states is suspected to be the work of a China-linked state-sponsored group. Schneier on Security reports Indian CA eMudhra Limited has eight TLS certificates with weak private keys. SecurityWeek reports Russia's APT28 hit NATO defence firms and that banks spotted rogue AI agents. BleepingComputer reports Microsoft will add AI-powered phishing detection to Teams messages starting early November 2026.