Arista VeloCloud Orchestrator
SQL injection letting any signed-in user act as superuser operator
FixThe fixed on-premises build for each train in Arista’s advisoryFurther readingArista advisory, further reading on Arista VeloCloud Orchestrator
Daily Brief
Monday, October 26, 2026
Added to KEV
2 additionsCollabora Online Built-in CODE Server
Command injection letting unauthenticated attackers run commands as the web server
Fix26.4.303 or later, or remove the app, since disabling it isn’t enoughFurther readingCollabora advisory, further reading on Collabora Online Built-in CODE Server
Source: CISA’s Known Exploited Vulnerabilities catalog, version 2026.10.23
Vulnerabilities and patches
3 items- Exploited
Palo Alto releases first PAN-OS hotfixes for exploited PHP flaws
Seven of the 20 hotfixes were out by Oct 26, and Palo Alto dates the rest from Oct 27 to Oct 30.
- Public exploit
Metasploit adds Langflow exploits, three of them needing no sign-in
Five of the modules run code on releases as old as 1.0.0, and IBM’s bulletin for the newest flaw says to upgrade to 1.12.3.
Second Java fix for eMudhra’s compromised certificates removes their roots
OpenJDK says runtimes updated in the past few days need it too, and Java on Debian and Ubuntu needs its keystore deleted and rebuilt by hand.
Breaches and campaigns
2 itemsLiteLLM traces its poisoned release to an agent platform key leaked in May
Microsoft published Defender hunting queries and hashes for seven poisoned wheels, and LiteLLM says the leaked key was never revoked.
Gheist campaign uses stolen GitHub tokens to dump secrets from private repos
Since Sep 15, Wiz has recovered more than 13,500 planted branches from over 850 compromised accounts, and GitHub’s approval hold stops the runs only in public repositories.
Worth reading
3 itemsCERT-FR
CERT-FR on lessons from nearly 200 data breaches through web applications
Many of the breaches it tracked in 2025 needed no software flaw, and its report, in French, gives ten measures with examples for several technologies.
Read: CERT-FR on lessons from nearly 200 data breaches through web applicationsDatadog
Datadog on pathrunner, a tool that exploits AWS privilege escalation paths
The open-source framework automates the IAM escalation paths Datadog catalogs, so defenders can tell which misconfigurations are exploitable.
Read: Datadog on pathrunner, a tool that exploits AWS privilege escalation pathsElastic
Elastic on turning a Zimbra log file into remote code execution
Several public proofs of concept for the Zimbra command injection flaw write a payload Zimbra’s Swatchdog never matches, so a failed test looks like a patched server.
Read: Elastic on turning a Zimbra log file into remote code execution