Security news.
Today's security landscape is dominated by active exploitation and critical supply chain exposures across major infrastructure and enterprise runtimes. CISA has issued urgent remediation orders for actively targeted vulnerabilities in Arista and Collabora platforms, while newly uncovered memory flaws in the Brotli compression library threaten multiple software ecosystems. Compounding these threats, recent supply chain breaches involving leaked credentials and unpatched PHP risks continue to place enterprise environments on high alert.
CISA Flags Actively Exploited Collabora and Arista Zero-Days
CISA added an OS command injection flaw in Collabora Online (CVE-2026-110447) and an Arista VeloCloud Orchestrator SQL injection bug to its Known Exploited Vulnerabilities catalog.
Brotli Decoder Flaw Enables RCE Across Node.js, Bun, and Python
A memory-corruption vulnerability (CVE-2026-111497) in Google's Brotli decoder allows maliciously crafted compressed streams to overflow buffers and execute code across runtimes and Envoy proxies.
Leaked Master Key Fuels Malicious LiteLLM Supply Chain Attack
An exposed deployment key on a public GitHub repository enabled attackers to hijack LiteLLM's release pipeline and push compromised packages to PyPI and Docker.
BlackX UEFI Bootkit Bypasses Secure Boot via Baton Drop Flaw
Suspected APT41 state-sponsored actors deployed the BlackX bootkit in espionage campaigns, exploiting unrevoked Secure Boot protections to neutralize endpoint defense tools.
PHP Issues Mitigation for New Unpatched Remote Code Execution Risk
The PHP maintainers shared mitigation steps for CVE-2026-115560, a remote code execution risk affecting non-standard application configurations hot on the heels of the PHP2Shell patching cycle.
HPE Patches Eight Critical RCE and Auth Bypass Bugs in ArubaOS
Hewlett Packard Enterprise issued fixes addressing 72 security flaws across ArubaOS, including eight maximum-severity bugs allowing unauthenticated remote takeover.
Enterprise VPN and Firewall Sweep Exposes 70,000 Edge Credentials
Threat actors targeted exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect appliances globally, exfiltrating over 70,000 corporate credentials for downstream network intrusions.
Security Firm Silently Patches 2 Million Popcorn Time Devices to Prevent Botnet
Researchers deployed remote updates to over 2 million endpoints running an abandoned Time4Popcorn fork, neutralizing a privileged background updater that posed severe RCE risks.