Daily Briefing

Arista VeloCloud Orchestrator zero-day under active attack; PHP ships emergency RCE patches

By The IT Security Desk

Good morning. The Hacker News reports that attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, per an Arista advisory dated October 22. The Hacker News says the flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges. BleepingComputer reports Arista released security updates to patch the actively exploited zero-day affecting VeloCloud Orchestrator On-Prem deployments. Follow the Arista advisory for the fixed build.

Schneier on Security reports that PHP maintainers released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities that can allow unauthenticated remote code execution, and that all PHP users are strongly encouraged to update immediately. Schneier lists the at-risk group as all PHP installations serving web requests. The Register reports a PHP2Shell exploit that bypasses protections designed to stop remote code execution.

Google's advisory lists six vulnerabilities in Chrome — CVE-2026-113342, CVE-2026-113336, CVE-2026-113328, CVE-2026-113300, CVE-2026-113283 and CVE-2026-113270 — affecting Chrome up to the fix in 156.0.8078.47, each carrying the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base score 9.6. Follow Google's advisory for the fixed release: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

Read the full briefing →

Zoom out: The Hacker News frames the week as already carrying critical PHP and GitLab RCE flaws, Linux bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release and hundreds of hijacked Tor relays.

Vulnerability in focus

CVE-2026-113342 — Google. CVSS 9.6

Affected: chrome.

What to do: Follow the vendor advisory for the fixed release and any interim mitigation.

Elsewhere

Help Net Security: AI is taking cybersecurity jobs at junior and experienced levels alike Read it
The Register: PHP2Shell exploit bypasses protections designed to stop remote code execution Read it
The Hacker News: Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks Read it
CISA: CISA Adds 20 Known Exploited Vulnerabilities to Catalog Read it
The Record: Indian tech company eMudhra announces withdrawal from certificate business after security incident Read it
CISA: Kiloview E3 NDI Encoder Read it
CISA: Siemens SIMATIC S7-1500 TM MFP Read it
CISA: Siemens SENTRON 3NA COM Fuse Read it
CISA: Siemens SIMATIC S7 PLCs Web Server Read it
CISA: Siemens Industrial Edge Devices Read it
CISA: Siemens SIMATIC IPCs Read it
CISA: Siemens RUGGEDCOM CROSSBOW Station Access Controller Read it

Sources

Railway warns devs to rotate secrets after potential breach BleepingComputer
Toronto crime tips org freezes operations after details of data breach come to light The Record
PHP2Shell exploit bypasses protections designed to stop remote code execution The Register
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks The Hacker News
Hacker Conversations: Corey Thuen and the Evil Bit SecurityWeek
New Serious PHP Vulnerabilities Released and Patched Schneier on Security
LiteLLM hit by second supply chain attack this year, users urged to rotate credentials Help Net Security
CISA Adds 20 Known Exploited Vulnerabilities to Catalog CISA
Capcom confirms data breach affecting 11.7 million accounts BleepingComputer
LiteLLM release pipeline hacked to distribute info-stealer malware BleepingComputer
Indian tech company eMudhra announces withdrawal from certificate business after security incident The Record
eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable The Hacker News
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More The Hacker News
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks BleepingComputer

Share this issue

Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky

Every briefing is on the site, with the advisory record behind it. All briefings