Security news.
Critical remote code execution flaws dominate today's briefing, led by weaponized exploit activity against newly patched core PHP vulnerabilities and an actively exploited SQL injection zero-day in Arista VeloCloud Orchestrator added to CISA's catalog. Meanwhile, enterprise supply chain and network perimeter risks remain elevated following an infostealer injection into the LiteLLM library and mass credential leaks from breached edge appliances. Developers and system administrators should prioritize patching core runtimes, securing network gateways, and auditing CI/CD authentication tokens.
CISA Flags Actively Exploited Arista VeloCloud Orchestrator Zero-Day
CISA has added CVE-2026-114625 to its Known Exploited Vulnerabilities Catalog following reports of in-the-wild exploitation against Arista VeloCloud Orchestrator on-prem installations to achieve operator privileges.
Mirai Botnet Mounts Mass Exploitation Wave Against PHP2Shell Vulnerabilities
Threat actors are conducting millions of exploit attempts against the recently patched PHP core vulnerabilities CVE-2026-109618 and CVE-2026-109619, while researchers warn of emerging ASLR bypass techniques and an additional unpatched configuration risk (CVE-2026-115560).
LiteLLM Supply Chain Attack Injects Infostealer via Python Startup Hooks
Attackers compromised the LiteLLM 1.107.0 release pipeline using stolen GitHub CLI OAuth credentials to publish backdoored PyPI packages and Docker containers designed to harvest cloud credentials and environment variables.
HPE Resolves 72 ArubaOS Vulnerabilities, Including Eight Max-Severity Flaws
Hewlett Packard Enterprise issued critical patches addressing multiple authentication bypass and remote code execution vulnerabilities carrying maximum 10.0 CVSS ratings across its ArubaOS network management platform.
Global Edge Appliance Campaign Exposes 70,000+ Enterprise Firewall and VPN Credentials
Researchers revealed a massive coordinated campaign targeting exposed perimeter appliances, including Palo Alto Networks GlobalProtect and Fortinet FortiGate gateways, leading to deep internal corporate compromises.
Ruby Updates Regex Engine to Mitigate Critical GitLab RCE Flaws
Ruby published security releases fixing three vulnerabilities in the embedded Onigmo regex engine that enabled remote memory corruption and served as the root cause for four critical GitLab execution flaws.
Python Pillow Library Vulnerability Permits Code Execution via Malicious Images
A critical command execution flaw (CVE-2026-112900) in Python's popular Pillow imaging library allows attackers to run operating system commands when parsing crafted EPS image files through unvalidated Ghostscript calls.
BlackX UEFI Bootkit Bypasses Secure Boot to Target Diplomatic Entities
State-sponsored threat actors linked to APT41 are deploying the BlackX bootkit in stealth cyber-espionage operations against Windows systems that lack updated Secure Boot certificate revocation lists.