BriefingSunday 25 October 202607:00 UTC
CISA adds two exploited flaws to its vulnerability catalogue
Security Affairs reported on 24 October that CISA had added exploited flaws in Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities catalogue, with federal agencies facing a 26 October 2026 remediation deadline. Security Affairs The reported cases differ in scope: the Collabora flaw affects Built-in CODE Server before version 26.4.303, while the VeloCloud issue affects on-premises deployments and allows an authenticated attacker to impersonate a local superuser. Security Affairs Collabora exploitation has been reported since September 2026, but the number of compromised servers remains unknown; the VeloCloud account gives no count of affected systems. Security Affairs
CISA adds an exploited flaw in Collabora Online#
Security Affairs reported on 24 October that CISA had added CVE-2026-110447 to its Known Exploited Vulnerabilities catalogue. Security Affairs The flaw is an OS command injection in Nextcloud’s proxy.php and affects Collabora Online Built-in CODE Server before version 26.4.303; standalone Collabora servers are not affected. Security Affairs
Security Affairs said exploitation had been reported since September 2026, with attacks using PHP web shells and accessing configuration files containing credentials and application secrets on affected systems. Security Affairs Administrators documented attacks on 10–11 September against version 26.4.302, and the total number of compromised servers remains unknown. Security Affairs
CISA adds an exploited flaw in Arista VeloCloud Orchestrator#
Security Affairs reported on 24 October that CISA had added CVE-2026-114625 to its Known Exploited Vulnerabilities catalogue. Security Affairs The SQL injection flaw, rated CVSS 9.4, affects on-premises VeloCloud Orchestrator deployments and can let an authenticated attacker gain operator privileges and impersonate a local superuser account. Security Affairs
The advisory says the flaw can expose internal functions not intended for remote use, potentially compromising the orchestrator and the data it manages. Security Affairs CISA set 26 October 2026 as the remediation deadline for federal agencies under Binding Operational Directive 22-01; hosted VeloCloud versions, including Dedicated deployments, have reportedly been patched. Security Affairs
LiteLLM confirms a leaked key led to a malicious release#
LiteLLM said a master key accidentally published to a public GitHub repository on 27 May 2026 remained active and was used by an unknown attacker on 10 October to access its Agent Platform. The Hacker News The Hacker News reported that the attacker used the access to introduce workflows designed to harvest tokens and API keys, then trigger and approve a release. The Hacker News
LiteLLM version 1.107.0 began publishing to PyPI on 21 October 2026, followed soon after by Docker Hub and GHCR images; PyPI later quarantined the package. The Hacker News The malicious package automatically executes on Python start, even without a LiteLLM import, and contains a credential-harvesting module and a Unix backdoor. The Hacker News
Also
- PHP2Shell. Security Affairs reported that AWS researchers observed PHP2Shell exploitation attempts against their honeypot network four days before public disclosure, while noting that attempts do not establish successful compromises. Security Affairs
- Capcom. Security Affairs reported that Capcom disclosed theft of 11,774,247 email addresses and account details after unauthorised access to CAPCOM ID on 19 October, with data exfiltration by 22 October. Security Affairs
- Popcorn Time. The Hacker News reported that Eye Security found CVE-2026-30612 in an updater for a discontinued Popcorn Time variant, estimating exposure at roughly 2.5–3 million Windows PCs and 250,000–350,000 Macs. The Hacker News
- Brotli. The Hacker News reported that Imperva demonstrated code execution on an unpatched Node.js 24.22.0 build on Linux ARM64, while no real-world attacks had been reported at disclosure. The Hacker News
Watching
CISA’s stated deadline for federal agencies to remediate the Collabora and VeloCloud flaws is ; the number of compromised Collabora servers remains unknown. Security Affairs