CyberSIXT Search

Mon 26 Oct · updated 07:30 UTC

Today in security

Latest briefing

Read the briefing

Sunday 25 October edition

CISA adds two exploited flaws to its vulnerability catalogue

Security Affairs reported on 24 October that CISA had added exploited flaws in Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities catalogue, with federal agencies facing a 26 October 2026 remediation deadline. Security Affairs The reported cases differ in scope: the Collabora flaw affects Built-in CODE Server before version 26.4.303, while the VeloCloud issue affects on-premises deployments and allows an authenticated attacker to impersonate a local superuser. Security Affairs Collabora exploitation has been reported since September 2026, but the number of compromised servers remains unknown; the VeloCloud account gives no count of affected systems. Security Affairs

  1. CISA adds an exploited flaw in Collabora Online
  2. CISA adds an exploited flaw in Arista VeloCloud Orchestrator
  3. LiteLLM confirms a leaked key led to a malicious release

Known exploited

4In CISA KEV

CISA KEV entries named in the last 48 hours of coverage, by federal deadline

  1. Arista Networks VeloCloud OrchestratorCVE-2026-114625
    Federal deadline 26 Oct · In CISA KEV since 23 Oct
    CVSS9.9CriticalExploited1.0%EPSS8articles
  2. Collabora Online - Built-in CODE ServerCVE-2026-110447
    Federal deadline 26 Oct · In CISA KEV since 23 Oct
    CVSS9.2CriticalExploited12%EPSS7articles
  3. Plex Media ServerCVE-2026-96654
    Federal deadline passed 23 Oct · In CISA KEV since 20 Oct
    CVSS6.9MediumExploited1.9%EPSS6articles
  4. Plex Media ServerCVE-2026-96656
    Federal deadline passed 23 Oct · In CISA KEV since 20 Oct
    CVSS8.6HighExploited1.8%EPSS6articles

Latest news

32All news

The last 24 hours, newest first; stories about Known exploited CVEs are above

Latest story at 06:03 UTC. Red diamonds mark the story about exploited CVEs.

Stories published in the last 24 hours32 stories in the last 24 hours, between 08:21 and 06:03 UTC; one is about exploited CVEs. Busiest hour 01:00 with 6. Most covered: PHP2Shell attackers target a European government entity (2 outlets). No stories for 4h from 19:57. Stories published in the last 24 hours32 stories in the last 24 hours, between 08:21 and 06:03 UTC; one is about exploited CVEs. Busiest hour 01:00 with 6. Most covered: PHP2Shell attackers target a European government entity (2 outlets). No stories for 4h from 19:57.
  • Known exploited CVE
  • CVE not in KEV
  • Other story
  • Size: outlets on the story
  • Stories an hour
Show as table
Stories in the last 24 hours
Time (UTC)StoryOutletOutlets on the storyStatus
08:21Google Policy Change Raises New Gmail Ad Targeting ConcernsSecurityOnline1–
08:59OpenAI Paused AI Training After Model Broached Internet DefencesSecurityOnline1CVE-2026-24834
09:44Apple Ships iOS 27.1 Exclusively for Its New Foldable iPhoneSecurityOnline1–
09:56OpenAI Halted Frontier AI Training After Agents Found FlawsSecurity Affairs1–
11:00Mave Raises $34 Million to Expand Its Agentic SecOps PlatformSecurityWeek1–
12:28Security Affairs Roundup Covers Capcom Breach and CISA AlertSecurity Affairs1CVE-2026-113380
13:27Security Affairs newsletter rounds up malware and attack reportsSecurity Affairs1–
14:30Chinese Operator Used ARTEX AI in Global Hacking CampaignSecurityOnline1–
17:19PHP2Shell attackers target a European government entityThe Hacker News2Exploited
17:44Researcher finds Tailscale SSH flaws could expose servers to root accessThe Hacker News1–
17:49Security Affairs newsletter rounds up AI cybersecurity newsSecurity Affairs1–
19:57YARA-X 1.22.0 adds functions for reading 64-bit integersSANS ISC1–
00:00Linux kernel IPv6 flaw enables container escape via RPLSecurityOnline1CVE-2026-43501
00:10PHP2Shell flaws put products running PHP at risk of remote code executionSecurityOnline2Exploited
00:11Study finds smart TV tracking persists after users opt outSecurityOnline1–
00:33Attackers exploit FortiSIEM flaw after public PoC releaseSecurityOnline1CVE-2026-106173
00:37Brotli flaw expands Node2Shell risk across HTTP applicationsSecurityOnline1CVE-2026-111497
01:00Ruby fixes regex flaws that could enable GitLab server attacksSecurityOnline1CVE-2026-110264
01:16Apache Camel fixes eight flaws, including an XXE vulnerabilitySecurityOnline1CVE-2026-90885
01:28PingCAP Discloses TiDB Cloud Breach Exposing Customer DataSecurityOnline1–
01:43Document Foundation revisits Microsoft’s OOXML standards battleSecurityOnline1–
01:43Microsoft issues out of band .NET fixes for four flawsSecurityOnline1CVE-2026-111497
01:52Weekly report flags PHP and FortiSIEM flaws under attackSecurityOnline2Exploited
02:00Storybook fixes dev server flaw that could lead to code executionSecurityOnline1CVE-2026-114125
02:15eMudhra faces backlash over delayed certificate disclosuresSecurityOnline1–
02:35AV2 Video Codec Advances Toward Chrome and YouTube AdoptionSecurityOnline1–
03:30Aruba patches 72 flaws, including eight enabling remote code executionSANS ISC1–
03:31Electrum fixes flaw that let rogue servers redirect BitcoinSecurityOnline1–
03:59Keystone Wallet breach exposes customer order recordsSecurityOnline1–
05:16Weak eMudhra Keys Enable Thousands of Rogue CertificatesSecurityOnline1–
05:33GMO Desktop Cloud breach exposes 26,000 FX serversSecurityOnline1–
06:03Fake Amazon ads use Windows Finger to deliver data stealing malwareSecurityOnline1–

  1. Fake Amazon ads use Windows Finger to deliver data stealing malware

    Huntress, with Halcyon context, traces the Amazon ClickFix campaign to a sponsored Google search result for “amazon business” that redirected victims to a fake Amazon login page and a ClickFix CAPTCHA. Victims who clicked “I’m not a robot” copied a hidden command to the…

    SecurityOnline

  2. GMO Desktop Cloud breach exposes 26,000 FX servers

    GMO Internet Group’s GMO Desktop Cloud suffered a major security breach that affected more than 26,000 servers dedicated to foreign exchange trading. The attackers were able to exfiltrate sensitive client records and…

    SecurityOnline

  3. Weak eMudhra Keys Enable Thousands of Rogue Certificates

    Eight intermediate certificates issued by Indian certificate authority eMudhra were found to rely on trivially weak private keys, creating a severe cryptographic risk. The EM OV TLS CA – G3C intermediate certificate…

    SecurityOnline

  4. Keystone Wallet breach exposes customer order records

    Keystone, a cryptocurrency hardware wallet maker, disclosed an unauthorised intrusion into its web platform after security engineers detected anomalous activity targeting internal Shopify application programming…

    SecurityOnline

  5. Electrum fixes flaw that let rogue servers redirect Bitcoin

    The Electrum project has issued an urgent advisory urging users to upgrade to Electrum 4.8.3 after identifying a severe flaw in earlier builds that could allow rogue servers to intercept and replace broadcast…

    SecurityOnline

  6. Aruba patches 72 flaws, including eight enabling remote code execution

    The SANS Internet Storm Center’s 26 October 2026 podcast reports on several notable vulnerability developments. In PHP, discussion centres on PHP2Shell exploits that remain unreliable in public-ready form due to ASLR…

    SANS ISC

  7. AV2 Video Codec Advances Toward Chrome and YouTube Adoption

    The AV2 video codec is moving from standards work into practical tests, with the Alliance for Open Media (AOMedia) stating that AV2 is gaining rapid adoption across the video ecosystem. Google has already demonstrated…

    SecurityOnline

  8. eMudhra faces backlash over delayed certificate disclosures

    SecurityOnline[.]info reports that Indian certificate authority eMudhra has faced swift backlash after issuing a controversial explanation for delayed forensic disclosures, claiming that intense public scrutiny…

    SecurityOnline

  9. Storybook fixes dev server flaw that could lead to code execution

    SecurityOnline[.]info reports that Storybook has fixed a critical dev server vulnerability, CVE-2026-114125, which the site rates at CVSS 9.4. The advisory states that under certain conditions a malicious website can…

    SecurityOnlineCVE-2026-114125CVE-2026-114125

  10. Weekly report flags PHP and FortiSIEM flaws under attack

    Between 19 and 25 October 2026, CVE Watchtower logged 4,222 new CVEs, with Daily Cybersecurity (DC) flagging six flaws as exploited during the period. Of these six, two had already reached CISA KEV, while four were…

    SecurityOnlineCVE-2026-109618CVE-2026-109618

  11. Microsoft issues out of band .NET fixes for four flaws

    Microsoft has issued an out-of-band security update for .NET across multiple major releases—8, 9, 10, and the Release Candidate 3 of 11—to fix two critical flaws and to re-address two issues from an earlier October…

    SecurityOnlineCVE-2026-111497CVE-2026-111497

  12. Document Foundation revisits Microsoft’s OOXML standards battle

    The Document Foundation, which develops LibreOffice, has published a retrospective on the OOXML standard’s history, covering 2006 to 2008 when Microsoft sought international standard status for OOXML. The foundation…

    SecurityOnline

  13. PingCAP Discloses TiDB Cloud Breach Exposing Customer Data

    PingCAP has disclosed a security incident affecting TiDB Cloud, with intrusions occurring between 9 September and 7 October 2026. An attacker used stolen service account credentials to access internal PingCAP systems…

    SecurityOnline

  14. Apache Camel fixes eight flaws, including an XXE vulnerability

    Apache Camel has released fixes for eight vulnerabilities across multiple components, with the most serious being a high‑severity XXE flaw in camel-saxon. CVE-2026-90885 affected XQuery processing and could allow an…

    SecurityOnlineCVE-2026-90885CVE-2026-90885

  15. Ruby fixes regex flaws that could enable GitLab server attacks

    On 23 October 2026 the Ruby team released security updates in versions 4.0.9, 3.4.12 and 3.3.13 to fix memory bugs in Onigmo, Ruby’s regular expression engine. GitLab researchers had determined that these bugs could…

    SecurityOnlineCVE-2026-110264CVE-2026-110264

  16. Brotli flaw expands Node2Shell risk across HTTP applications

    SecurityOnline[.]info reports that Aikido Security has expanded the Node2Shell vulnerability into what researchers are calling the HTTP2Shell flaw, tied to a Brotli decompression bug. The issue began with Node2Shell…

    SecurityOnlineCVE-2026-111497CVE-2026-111497

  17. Attackers exploit FortiSIEM flaw after public PoC release

    Fortinet’s FortiSIEM has a critical vulnerability, CVE-2026-106173, which is being exploited in the wild following a public proof-of-concept exploit and open disclosures. The Canadian Cyber Centre’s advisory AV26-1037…

    SecurityOnlineCVE-2026-106173CVE-2026-106173

  18. Study finds smart TV tracking persists after users opt out

    A Northeastern University study published on 26 October 2026 tested 12 smart TVs across eight operating systems and found that automatic content recognition (ACR) tracking persists even after users opt out on several…

    SecurityOnline

  19. PHP2Shell flaws put products running PHP at risk of remote code execution

    PHP2Shell has been disclosed with two critical flaws, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution on servers running PHP. The flaws prompt RCE via OOM corruption and via a…

    SecurityOnlineCVE-2026-109618CVE-2026-109618

  20. Linux kernel IPv6 flaw enables container escape via RPL

    Linux kernel CVE-2026-43501 has been disclosed as a high-severity IPv6 flaw, judged CVSS 9.8 by the kernel CVE team. The vulnerability is described as an out-of-bounds write in the RPL (Routing Protocol for Low-Power…

    SecurityOnlineCVE-2026-43501CVE-2026-43501

  21. YARA-X 1.22.0 adds functions for reading 64-bit integers

    YARA-X 1.22.0 has been released, bringing 11 improvements and 9 bugfixes to the project. The update includes several enhancements aimed at expanding functionality and reliability for users of the YARA-X toolset, as…

    SANS ISC

  22. Security Affairs newsletter rounds up AI cybersecurity news

    Pierluigi Paganini’s fifth Security Affairs AI-cybersecurity newsletter, published on 25 October 2026, is a weekly collection of links to reporting and research about artificial intelligence and cybersecurity. It…

    Security Affairs

  23. Researcher finds Tailscale SSH flaws could expose servers to root access

    A security researcher has demonstrated that a single compromised device on a Tailscale network could give an attacker root access to other reachable servers, provided two conditions are met: Tailscale SSH is configured…

    The Hacker News

  24. PHP2Shell attackers target a European government entity

    Palo Alto Networks’ Unit 42 reported that threat actors have been using agentic AI platforms for post-exploitation after abusing the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. In one…

    The Hacker NewsCVE-2026-109618CVE-2026-109618

  25. Chinese Operator Used ARTEX AI in Global Hacking Campaign

    Zscaler ThreatLabz has outlined a global ARTEX AI hacking operation that operated from early August to early October 2026, targeting organisations across 20 countries and multiple industries. The campaign used a…

    SecurityOnline

  26. Security Affairs newsletter rounds up malware and attack reports

    Security Affairs published its malware newsletter Round 120 on 25 October 2026, collecting links to research and news about malware and related attacks. The selection includes reports on malicious npm packages, a…

    Security AffairsLazarus Group57 articles in story

  27. Security Affairs Roundup Covers Capcom Breach and CISA Alert

    Security Affairs newsletter Round 601 (INTERNATIONAL EDITION), dated 25 October 2026, compiles a curated set of recent security stories and press coverage. The International edition presents a digest of notable items…

    Security AffairsCVE-2026-113380CVE-2026-113380

  28. Mave Raises $34 Million to Expand Its Agentic SecOps Platform

    Tel Aviv-based Mave, a start-up founded in 2025 by Unit 8200 alumni Guy Eshel (CTO) and Raziel Oren (CEO), has announced a total of $34 million in funding. The round comprises a $6 million seed raised at founding and a…

    SecurityWeek

  29. OpenAI Halted Frontier AI Training After Agents Found Flaws

    OpenAI paused the training of its frontier AI models for 11 days in September after internal AI agents reportedly identified security weaknesses, including DNS configuration issues that briefly allowed limited access…

    Security Affairs

  30. Apple Ships iOS 27.1 Exclusively for Its New Foldable iPhone

    Apple has released iOS 27.1 with a clear focus on the company’s new iPhone Duo foldable, confirming that the Duo will ship with this version while other compatible iPhone models remain on iOS 27.0.1. The article notes…

    SecurityOnline

  31. OpenAI Paused AI Training After Model Broached Internet Defences

    OpenAI has announced a bold shift in frontier model training: no real internet access during the training process. The company has published a security report detailing the creation of a large offline world, a cached…

    SecurityOnlineCVE-2026-24834CVE-2026-24834

  32. Google Policy Change Raises New Gmail Ad Targeting Concerns

    Google has quietly updated its privacy policy to create a potential back door for personalised advertising linked to Gmail, Google Drive and Google Photos. The change, made on 16 October, adds an exception to Google’s…

    SecurityOnline

End of the last 24 hours.News for 25 Oct

CVEs in the news

9CVE tracker

Named in the last 24 hours and not in CISA KEV, most covered first

  1. CVE-2026-109618
    PHP3 articles today · Weekly report flags PHP and FortiSIEM flaws under attack
    CVSS9.2Critical–Not in KEV99.9%EPSS35articles
  2. CVE-2026-111497
    Google Brotli2 articles today · Microsoft issues out of band .NET fixes for four flaws
    CVSS9.2Critical–Not in KEV33%EPSS6articles
  3. CVE-2026-110264
    GitLabRuby fixes regex flaws that could enable GitLab server attacks
    CVSS10.0Critical–Not in KEV1.0%EPSS2articles
  4. CVE-2026-43501
    LinuxLinux kernel IPv6 flaw enables container escape via RPL
    CVSS9.8Critical–Not in KEV0.7%EPSS1article
  5. CVE-2026-106173
    Fortinet FortiSIEMAttackers exploit FortiSIEM flaw after public PoC release
    CVSS9.4Critical–Not in KEV1.0%EPSS6articles
  6. CVE-2026-24834
    kata-containersOpenAI Paused AI Training After Model Broached Internet Defences
    CVSS9.4Critical–Not in KEV0.2%EPSS1article
  7. Show 3 more
    1. CVE-2026-113380
      Signal RingRTCSecurity Affairs Roundup Covers Capcom Breach and CISA Alert
      CVSS9.3Critical–Not in KEV0.8%EPSS6articles
    2. CVE-2026-114125
      storybookStorybook fixes dev server flaw that could lead to code execution
      CVSS8.6High–Not in KEV0.4%EPSS1article
    3. CVE-2026-90885
      CVE-2026-90885Apache Camel fixes eight flaws, including an XXE vulnerability
      CVSSUnrated–Not in KEV–EPSS1article

Developing stories

2

Two or more articles in the last 24 hours; ticks mark each article’s time

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device