Cyber News

Daily coverage of exploited vulnerabilities, breaches and patches, with what to do first.

Inside the Daily Brief

A real sample of the weekday read

CISA confirms attacks on Nextcloud’s Collabora CODE app. The federal fix date is today

CISA confirms attacks on Nextcloud’s Collabora CODE app. The federal fix date is today

CISA added CVE-2026-110447 in Nextcloud’s Collabora Built-in CODE Server app to KEV on Oct 23, due Oct 26. Update richdocumentscode to 26.4.303 or remove it, then hunt for web shells.
A Brotli decoder bug sits inside Node.js, Python and Envoy. Update each one, then restart

A Brotli decoder bug sits inside Node.js, Python and Envoy. Update each one, then restart

CVE-2026-111497 in Google Brotli 1.0.3-1.2.0 reaches Node.js, Bun, Envoy and Python Brotli packages. Update to Node.js 22.23.4, 24.22.1 or 26.12.1, Brotli 1.2.1, then restart.
Aruba wireless controllers and access points have eight 10.0 flaws. Plan the AOS upgrades this week

Aruba wireless controllers and access points have eight 10.0 flaws. Plan the AOS upgrades this week

HPE advisory HPESBNW05162 fixes 72 AOS-8 and AOS-10 flaws, eight rated 10.0 (CVE-2026-79844 to 79851). Upgrade to 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24.

The CyberExperts Daily Brief

Keep up with the cyber news that changes the day

Get the weekday brief for people scanning the news: the developments worth a closer look, explained in about five minutes.

ConnectWise Cloud Backup starts coming back Monday. Check your Microsoft 365 tenants before you reconnect

ConnectWise Cloud Backup starts coming back Monday. Check your Microsoft 365 tenants before you reconnect

ConnectWise targets Oct 26 to start restoring Cloud Backup (SkyKick) after its app credential was abused in Microsoft 365 tenants. App IDs, IOCs and checks before reconnecting.
Friday’s brief: GitLab’s 10.0 fix, then VeloCloud attacks, a poisoned LiteLLM release and PHP2Shell logs to check

Friday’s brief: GitLab’s 10.0 fix, then VeloCloud attacks, a poisoned LiteLLM release and PHP2Shell logs to check

GitLab CVE-2026-110264, exploited VeloCloud CVE-2026-114625, the LiteLLM 1.107.0 malware and PHP2Shell attacks from Oct 17, with first steps for each.
PHP2Shell attacks began four days before the patch. Check your PHP servers’ logs back to October 17

PHP2Shell attacks began four days before the patch. Check your PHP servers’ logs back to October 17

Amazon saw PHP2Shell (CVE-2026-109618, CVE-2026-109619) exploit attempts on Oct 17, four days before PHP 8.5.12 and 8.4.27. Hunt web logs from Oct 17.
A fake LiteLLM release stole AI and cloud keys for two hours. Check whether anything installed 1.107.0

A fake LiteLLM release stole AI and cloud keys for two hours. Check whether anything installed 1.107.0

Malicious LiteLLM 1.107.0 wheels and Docker images stole credentials on Oct 21. Find cook.pth and sitecustomize.py, rebuild on 1.106.2 and rotate every key.
Attackers are turning read-only VeloCloud logins into superusers. Upgrade your on-prem orchestrator now

Attackers are turning read-only VeloCloud logins into superusers. Upgrade your on-prem orchestrator now

Arista says CVE-2026-114625 (9.9), an SQL injection in on-prem VeloCloud Orchestrator, is exploited. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 and block two IPs.
Self-hosted GitLab servers can be made to run an outsider’s code. Upgrade to 19.5.1, 19.4.3 or 19.3.6 today

Self-hosted GitLab servers can be made to run an outsider’s code. Upgrade to 19.5.1, 19.4.3 or 19.3.6 today

CVE-2026-110264 (CVSS 10.0) lets unauthenticated attackers run code on self-managed GitLab CE/EE. Upgrade to 19.5.1, 19.4.3, 19.3.6 or a backport and check the logs.
Thursday’s brief: Fortinet’s firewall fixes land today, then Cisco Expressway, eMudhra certificates and PHP2Shell

Thursday’s brief: Fortinet’s firewall fixes land today, then Cisco Expressway, eMudhra certificates and PHP2Shell

Fortinet’s Oct 22 FortiOS fixes, Cisco Expressway CVE-2026-76466, eMudhra CVE-2026-111943 and PHP2Shell CVE-2026-109618, with first steps for each.
PHP2Shell patches are out and attackers are already trying them. Confirm every PHP server runs the new version

PHP2Shell patches are out and attackers are already trying them. Confirm every PHP server runs the new version

PHP2Shell CVE-2026-109618 and CVE-2026-109619 (9.2) are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Exploit attempts have started; update and restart workers.
Browsers already block eMudhra’s broken certificates. Your servers, containers and Go apps need an update to do the same

Browsers already block eMudhra’s broken certificates. Your servers, containers and Go apps need an update to do the same

Eight eMudhra intermediate CA keys were recoverable. Go fixed CVE-2026-111943 in 1.27.3/1.26.10; update ca-certificates, Java, Node and certifi, then rebuild.
Clustered Cisco Expressway servers can be taken over as root without a login. Upgrade to X15.5.20, then Unified CM

Clustered Cisco Expressway servers can be taken over as root without a login. Upgrade to X15.5.20, then Unified CM

CVE-2026-76466 (9.8) lets unauthenticated attackers run root commands on clustered Cisco Expressway. Upgrade to X15.5.20 and Unified CM to 15SU5.