Security news.
Active zero-day exploitation and high-impact infrastructure flaws dominate today's briefing, led by in-the-wild attacks targeting VeloCloud SD-WAN networks and weaponized mass exploitation of PHP core vulnerabilities. Meanwhile, enterprise vendors HPE and Atlassian released substantial security updates addressing dozens of critical flaws, and supply chain attackers targeted developer workflows in LiteLLM and Railway.
Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months
Arista has issued an emergency patch for an actively exploited SQL injection zero-day in VeloCloud Orchestrator (VCO) On-Prem deployments that lets authenticated users escalate privileges to full operator control.
Mirai Operators Target Critical PHP2Shell Bugs as ASLR Bypasses Emerge
Botnet operators are actively attempting to weaponize the newly disclosed PHP core vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with emerging ASLR bypass exploits, as PHP separately warns of an additional unpatched RCE vector (CVE-2026-115560).
HPE Patches Eight Maximum-Severity RCE and Auth Bypass Flaws in ArubaOS
Hewlett Packard Enterprise published security updates resolving 72 total vulnerabilities in the Aruba Operating System, including eight critical 10.0-severity authentication bypass and remote code execution flaws.
LiteLLM Hit by Supply Chain Attack Distributing Info-Stealer Malware
Attackers used compromised GitHub CLI OAuth tokens to publish malicious PyPI packages and Docker container images containing payloads designed to harvest credentials, secrets, and environment variables.
Critical Flaw in Python's Pillow Image Library Enables Remote Code Execution
A high-impact flaw (CVE-2026-112900) in the widely used Pillow library allows attackers to run arbitrary OS commands by passing maliciously crafted EPS file names directly to Ghostscript without sanitization.
Node2Shell Exploit Demonstrates RCE via Node.js Brotli Decoder
Security researchers released a working proof of concept demonstrating remote code execution on official Node.js 24.22.0 images using crafted Brotli decompression input (CVE-2026-111497) without requiring debugging tools.
eMudhra Exits Global TLS Market After Intermediate CA Private Keys Recovered
Indian certificate authority eMudhra is shutting down its global SSL/TLS operation after a security researcher managed to recover the private keys of eight intermediate CA certificates.
Capcom Discloses Data Breach Exposing 11 Million Account Records
Japanese video game developer Capcom confirmed a security breach targeting its CAPCOM ID service, resulting in the theft of over 11 million user email addresses and unauthorized password changes.