Good morning. Start with the issue most likely to reshuffle someone's priority list today, then move through the supporting developments that deserve attention.
Lead Story
Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw
Arista has confirmed that attackers exploited CVE-2026-16812 (CVSS 10.0), an OS command injection flaw in on-premises VeloCloud Orchestrator, before a fix was available. Fixed releases are 5.2.3.14, 6.1.3.4, 6.4.2.4 and 7.0.0.1; Hosted and Dedicated deployments were patched in advance, and Gateways and Edges are not affected.
Why it matters: The orchestrator controls an entire SD-WAN estate, so a compromise reaches far beyond one device. CISA has set a July 30 deadline for federal agencies.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Read more on CyberExperts: Read more on CyberExperts
Original source: The Hacker News
Recommended action: Upgrade on-premises orchestrators, limit management access, and search for the indicator IPs 8.19.75.217, 206.72.242.124 and 206.72.242.162.
Also Worth Your Attention
Arista patches VeloCloud Orchestrator zero-day exploited in attacks
BleepingComputer’s report on the same zero-day covers Arista’s fixed releases for the affected 5.2.x, 6.1.x, 6.4.x and 7.0.x lines of on-premises VeloCloud Orchestrator.
Why it matters: Teams on hosted VeloCloud may assume they are covered; anyone running VCO on-premises owns the fix.
Read more on CyberExperts: Read more on CyberExperts
Original source: BleepingComputer
Recommended action: Confirm deployment type for every orchestrator before closing the ticket.
Begun, the Patch Wars have
In Talos’s Threat Source newsletter, Joe Marshall looks at July’s record Microsoft Patch Tuesday: 622 vulnerabilities, 62 rated critical and three zero-days, two of them actively exploited. Microsoft attributes the surge to AI-accelerated research. The issue also covers UAT-11795, a Russian-speaking group using trojanized Webex, Zoom and MobaXterm installers to deliver “Starland RAT.”
Why it matters: Change-management processes sized for a far smaller monthly load will struggle if this volume becomes normal, and resource-limited vendors may ship fixes more slowly.
Read more on CyberExperts: Read more on CyberExperts
Original source: Cisco Talos
Recommended action: Review whether test-and-deploy cycles can absorb larger monthly releases, and prioritize by exploitation status and KEV listing.
Microsoft Says New Cybersecurity AI Model Helps MDASH Score 95.95% at Half the Cost
Microsoft says MDASH, its multi-model vulnerability harness, scored 95.95% on CyberGym using its new MAI-Cyber-1-Flash model alongside GPT-5.4, at about half the cost of its previous best model mix. The model is available only inside MDASH through an Azure AI Foundry private preview.
Why it matters: The score belongs to the whole system, not the model alone, and CyberGym Level 1 measures reproducing known vulnerabilities, not finding new ones or writing correct patches.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Read more on CyberExperts: Read more on CyberExperts
Original source: The Hacker News
Recommended action: Treat vendor AI benchmark claims as directional and ask how they were measured before using them in tooling decisions.
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added Fortinet FortiOS CVE-2025-68686 and Arista VeloCloud Orchestrator CVE-2026-16812 to the KEV catalog on July 27. The FortiOS flaw lets attackers bypass the fix for the SSL-VPN symlink persistence mechanism on devices already compromised at file-system level.
Why it matters: Both entries are network-infrastructure problems, and the FortiOS listing is about attackers keeping access after an earlier breach.
Read more on CyberExperts: Read more on CyberExperts
Original source: CISA
Recommended action: Upgrade FortiOS to 7.6.2 or 7.4.7 or later (or migrate older branches) and patch on-premises VeloCloud Orchestrators.
Go Deeper
CyberExperts should help you get the signal fast, understand what actually matters, and know where to go deeper before the day gets noisy.
Get the Daily Brief every weekday morning.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
