Security news.
Critical software security concerns dominate today's updates, led by CISA flagging actively exploited vulnerabilities in enterprise appliances and severe flaws rippling through the Brotli decoder and PHP ecosystems. Meanwhile, researchers are uncovering sophisticated new threats, including a Secure Boot-bypassing UEFI bootkit and major software supply chain compromises. Engineering and IT teams should immediately review patching priorities for edge network infrastructure, runtimes, and critical dependencies.
CISA Adds Exploited Flaws in Collabora Online and Arista VeloCloud to KEV
CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including an OS command injection flaw (CVE-2026-110447) in Collabora Online Built-in CODE Server and an Arista VeloCloud Orchestrator SQL injection issue.
Brotli Decoder Flaw Affects Bun, Python, and Other Ecosystems
A memory-corruption vulnerability in Google's Brotli decoder (CVE-2026-111497) impacts numerous runtimes and tools—including Node.js, Bun, and Python packages—allowing specially crafted compressed streams to corrupt memory and potentially execute arbitrary code.
BlackX UEFI Bootkit Bypasses Secure Boot via Baton Drop Flaw
Threat actors deployed a new UEFI bootkit called BlackX in targeted cyber-espionage operations, exploiting the Baton Drop flaw on unrevoked Windows systems to load malicious drivers and neutralize endpoint security tools.
Leaked Master Key Triggers Malicious LiteLLM Supply Chain Poisoning
An accidentally published Agent Platform master key in a public repository enabled attackers to hijack LiteLLM's GitHub and package pipelines to publish compromised releases with credential-harvesting hooks.
Advisories Warn of Critical RCE Flaws Across PHP Infrastructure
Security researchers and vendors continue to issue urgent advisories regarding critical core vulnerabilities CVE-2026-109618 and CVE-2026-109619, as proof-of-concept exploits circulate and botnets begin targeting vulnerable deployments.
HPE Patches 72 ArubaOS Vulnerabilities Including 8 Max-Severity Flaws
Hewlett Packard Enterprise issued critical patches addressing dozens of security vulnerabilities across ArubaOS, featuring eight CVSS 10.0 remote code execution and authentication bypass flaws.
Ruby Releases Security Updates for Regex Engine Memory Corruption Flaws
Ruby developers rolled out versions 4.0.9, 3.4.12, and 3.3.13 to resolve three vulnerabilities in the Onigmo regular expression engine that were linked to multiple critical remote code execution flaws in GitLab.
Global Edge Appliance Campaign Exposes 70,000 Enterprise Credentials
Attackers targeting perimeter infrastructure—including Fortinet FortiGate and Palo Alto Networks GlobalProtect instances—have harvested over 70,000 corporate credentials for subsequent lateral enterprise compromise.