Vulnerabilities & remediation
The 4 selected developments in vulnerabilities & remediation put vulnerabilities & remediation on the week's review agenda. CISA Adds One Known Exploited Vulnerability to Catalog; Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st); Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks; Critical Vulnerabilities in PHP Require Immediate Patching. These reports are related by theme, not assumed to be one campaign.
- Related coverage is grouped by theme; source links identify the original reporting.
CISA Adds One Known Exploited Vulnerability to Catalog
CISA reports: CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
SANS Internet Storm Center reports: PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits before the patch became available.
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
The Hacker News reports: Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it.
Critical Vulnerabilities in PHP Require Immediate Patching
CISA reports: Update October 23, 2026: CISA has updated this Alert to: (1) provide a SIGMA detection rule to help identify potentially suspicious activity; (2) incorporate partner resources; and (3) reinforce existing mitigation guidance. Purpose CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619.
Cloud, Identity & SaaS
The 4 selected developments in cloud, identity & saas put cloud, identity & saas on the week's review agenda. Managing AI Token Consumption for Operational Resilience; Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites; Railway warns devs to rotate secrets after potential breach; The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat. These reports are related by theme, not assumed to be one campaign.
- Related coverage is grouped by theme; source links identify the original reporting.
Managing AI Token Consumption for Operational Resilience
CISA reports: CISA, the Canadian Centre for Cyber Security (Cyber Centre), and partners are releasing joint guidance, Managing AI Token Consumption for Operational Resilience, to help organizations understand and manage token usage in support of operations.
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
The Hacker News reports: Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations.
Railway warns devs to rotate secrets after potential breach
BleepingComputer reports: Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week.
The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat
The Hacker News reports: Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching. Nobody reviewed its access. Nobody owns it. If an employee had that much reach with that little oversight, you would call it an insider risk. So why do we still call the agent a productivity tool?
Cybercrime & Fraud
The 2 selected developments in cybercrime & fraud put cybercrime & fraud on the week's review agenda. Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials; Machine speed attacks require machine speed detection and response. These reports are related by theme, not assumed to be one campaign.
- Related coverage is grouped by theme; source links identify the original reporting.
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
The Hacker News reports: Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.
Machine speed attacks require machine speed detection and response
BleepingComputer reports: Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks involving stolen GitHub tokens, malicious AI installers, and MFA phishing, explaining why faster detection and automated containment are critical.
Ransomware & Extortion
The 1 selected development in ransomware & extortion put ransomware & extortion on the week's review agenda. Quest Diagnostics warns of potential data theft after attack on lab service system. These reports are related by theme, not assumed to be one campaign.
- Related coverage is grouped by theme; source links identify the original reporting.
Quest Diagnostics warns of potential data theft after attack on lab service system
The Record reports: Nationwide lab test company Quest Diagnostics said one of its key systems may have experienced a breach of patient data.
- Prioritize exposure checks and patch planning because these stories usually point to weaknesses defenders can reduce quickly.
- Identity and cloud stories usually deserve a configuration review because small permission mistakes can become broad exposure.
- These items often reveal how attackers monetize access, so they are useful for tuning detection and user-facing controls.
- Treat these as resilience stories: backup integrity, identity hardening and incident communications matter as much as prevention.