CISA flags actively exploited Arista VeloCloud SQL injection as PHP warns of an unpatched 9.8 RCE
One confirmed in-the-wild flaw hit CISA's catalogue, PHP issued mitigation for an unpatched remote code execution bug, Google Chrome and Ruby shipped fixes, and researchers tallied tens of thousands of stolen edge-device credentials.
CISA added an Arista VeloCloud Orchestrator SQL injection vulnerability to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, according to CISA. CISA's alert states that Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritise rapid remediation of CVEs listed in the KEV Catalog. If you run VeloCloud Orchestrator, treat this as the day's priority: apply the vendor's fix and check for exploitation.
BleepingComputer reports the PHP security team has shared mitigation measures for a new remote code execution vulnerability that has no patch and affects systems with non-default configurations. The advisory record lists this as CVE-2026-109618 with a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 9.8. With no fixed release available, follow the mitigation in PHP's advisory (https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w).
Google's Chrome stable channel update fixes five flaws — CVE-2026-113342, CVE-2026-113336, CVE-2026-113328, CVE-2026-113300 and CVE-2026-113283 — each carrying the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H and a base score of 9.6, per the advisory record. Google's advisory lists the fix in version 156.0.8078.47 (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html). Update Chrome and restart the browser.
The Hacker News reports Ruby released versions 4.0.9, 3.4.12 and 3.3.13 to fix three bugs in the Onigmo regular expression engine that lie behind four critical security flaws GitLab patched over the past month. Patch Ruby and GitLab accordingly.
The Hacker News also reports a large-scale campaign against exposed network edge devices including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, exposing over 70,000 credentials. Help Net Security reports that, according to Huntress, an attacker replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organisations between July 14 and September 22, 2026, using hidden inbox rules to hide mail from victims. Review edge-device exposure and Microsoft 365 inbox rules and sessions.
In further reporting: BleepingComputer says Quest Diagnostics confirmed patient records were exposed after a threat actor accessed its Quanum LSM system. The Hacker News reports a UEFI bootkit called BlackX that bypasses Secure Boot on patched Windows systems missing revocations, with activity against diplomatic entities in Tajikistan, Uzbekistan and Turkmenistan in early 2026 that The Hacker News states is suspected to be the work of a China-linked state-sponsored group. Schneier on Security reports Indian CA eMudhra Limited has eight TLS certificates with weak private keys. SecurityWeek reports Russia's APT28 hit NATO defence firms and that banks spotted rogue AI agents. BleepingComputer reports Microsoft will add AI-powered phishing detection to Teams messages starting early November 2026.
Sources
- BleepingComputer — Abandoned Popcorn Time app exposed millions of device to RCE attacks
- The Register — Red-team report found OpenAI utterly failed to monitor its agents during Hugging Face attack
- The Hacker News — BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
- The Record — FCC bans two devices with surveillance chips linked to Huawei
- SecurityWeek — In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
- CISA — CISA Adds One Known Exploited Vulnerability to Catalog
- Help Net Security — Microsoft 365 accounts compromised at 79 organizations, no passwords needed
- Schneier on Security — Compromised TLS Certificates
- BleepingComputer — Microsoft Teams to get AI-powered, context-aware phishing detection
- The Hacker News — Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
- The Hacker News — Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
- BleepingComputer — Quest Diagnostics confirms data breach exposed patient records
- BleepingComputer — PHP shares mitigation for new RCE vulnerability with no patch
- The Hacker News — Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials