Vulnerabilities & remediation
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
The Hacker News reports: Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it.
Vulnerabilities & remediation
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
BleepingComputer reports: Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments.
Cloud, Identity & SaaS
Managing AI Token Consumption for Operational Resilience
CISA reports: CISA, the Canadian Centre for Cyber Security (Cyber Centre), and partners are releasing joint guidance, Managing AI Token Consumption for Operational Resilience, to help organizations understand and manage token usage in support of operations.
Cloud, Identity & SaaS
Railway warns devs to rotate secrets after potential breach
BleepingComputer reports: Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week.
Cloud, Identity & SaaS
The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat
The Hacker News reports: Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching. Nobody reviewed its access. Nobody owns it. If an employee had that much reach with that little oversight, you would call it an insider risk. So why do we still call the agent a productivity tool?
AI & Security
Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents
The Record reports: A Chinese government-aligned hacking group used automated tools to carry out the recent supply chain attack on IT management software company ConnectWise and is using the same techniques to try to compromise organizations around the globe, Microsoft said.
Cybercrime & Fraud
Machine speed attacks require machine speed detection and response
BleepingComputer reports: Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks involving stolen GitHub tokens, malicious AI installers, and MFA phishing, explaining why faster detection and automated containment are critical.
Vulnerabilities & remediation
Siemens RUGGEDCOM CROSSBOW
CISA reports: View CSAF Summary RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such as modifying system configurations or causing a denial of service.