Dan's Brief
← 2026-10-22

Arista VeloCloud Orchestrator zero-day exploited, patches released

Published 7:01 AM · 120 articles from 13 sources · about 4 min to read in full

The day in brief

The sharpest new development is in management software, which attackers keep using as an entry point. Arista disclosed an actively exploited zero-day in VeloCloud Orchestrator, a SQL injection that lets read-only users become operators. Microsoft separately attributed a ConnectWise breach to a China-aligned group that used AI agents to reach 2,250 cloud tenants. PHP2Shell, covered yesterday, has moved from targeted exploitation to mass attempts: attackers are trying to drop a Mirai variant, and the UK says 32 government services went offline. Secrets exposure continues. Railway now says some customer secrets were decrypted and tells all users to rotate them, and eMudhra is leaving the TLS business after researchers recovered eight intermediate CA keys. Disclosure hygiene is also under strain, as two CVSS 9.0 KSMBD flaws surfaced on public lists before any mainline fix. Elsewhere, a Pillow flaw allows code execution through a crafted EPS image, a New Mexico court ordered Meta to pay $25 billion, and OpenAI is reportedly raising $30 billion at a $1.25 trillion valuation. Q3 PC shipments fell 21 percent on RAM prices.

Top stories

  1. 1
    Arista VeloCloud Orchestrator zero-day exploited, patches released

    Arista warned that a SQL injection zero-day in VeloCloud Orchestrator is under active attack and lets read-only users gain operator privileges. Patches cover the On-Prem deployments. The orchestrator controls the network fabric, so operator rights there are a serious foothold. The Hacker News · 5 min read

  2. 2
    Microsoft: ConnectWise breach gave Chinese spies access to 2,250 tenants

    Microsoft attributed the ConnectWise breach to a China-aligned group that used AI agents to do the intrusion work across thousands of customers. The Register puts the reach at 2,250 cloud tenants. It is a supply-chain compromise through an IT management vendor, and the attackers automated it at scale. The Register · 3 min read

  3. 3
    Pillow flaw lets a crafted EPS image run OS commands

    CVE-2026-112900 in Python's Pillow library allows OS command execution when crafted EPS images are passed unchecked to Ghostscript. Pillow sits behind a great many upload and image-processing paths, so any service that renders untrusted images should check exposure. The summary gives no affected versions. The Hacker News · 5 min read

  4. 4
    Court orders Meta to pay $25 billion over 43 million privacy violations

    A New Mexico court ordered the payment over privacy violations tied to the Cambridge Analytica scandal. The size of the award makes it a significant precedent for per-violation privacy penalties. The summary does not say whether Meta will appeal. The Hacker News · 3 min read

  5. 5
    OpenAI reportedly raising $30B at $1.25T valuation ahead of IPO

    The raise would be a record for a private company and comes ahead of a possible IPO. It shows how much capital is still flowing into frontier AI labs, while the security stories above show the cost of the tooling built around them. TechCrunch · 2 min read

Since yesterday

  • PHP2Shell exploitation is now at scale. Attackers are using CVE-2026-109618 and CVE-2026-109619 to try to deploy the Potassium Mirai botnet variant, with millions of attempts and limited success so far. The Hacker News ↗
  • PHP2Shell knocked 32 UK government services offline and partly disrupted four more, though no compromise is confirmed. The Register also reports the exploit bypasses existing protections designed to stop remote code execution. The Register ↗
  • Railway now tells all users to revoke and rotate secrets, saying attackers decrypted some customer secrets. This is more serious than the earlier 'suspicious activity' wording, but no count of affected customers is given. TechCrunch ↗
  • eMudhra will exit the global SSL/TLS certificate business after researchers recovered the private keys of eight intermediate CA certificates, which were easily guessable. This reverses the earlier 'minor error' framing. A separate researcher also published a full bypass of eMudhra's single-factor OTP login. The Hacker News ↗
  • The leaked Linux kernel reports now have specifics: two CVSS 9.0 remote code execution flaws in KSMBD were reported by ZDI and disclosed on public mailing lists before any mainline fix exists. The Hacker News ↗

By topic

Themes today

Read the analysis →
  • Management software is the preferred way in
  • AI agents are now both attackers and targets
  • Disclosure pipelines are leaking before fixes ship
  • Platform secrets stores are a single point of failure
  • Trust anchors are being pulled, not repaired
Written by claude-sonnet-5-5 from feed titles and summaries. The model can misstate details; every claim links to its source.