Arista says attackers are exploiting a SQL injection in on-prem VeloCloud Orchestrator. It is the third exploited flaw in that product since July. Node.js fixed a Brotli decoder bug that researchers turned into code execution, and a commercial PHP2Shell exploit now works reliably on standard x86-64 servers. Railway, meanwhile, says customer environment variables were decrypted.

Do today

  • VeloCloud Orchestrator (on-prem): upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12, then review recent admin changes. (Arista advisory 0199)
  • Node.js: upgrade to 22.23.4, 24.22.1 or 26.12.1, and move anything on 20.x or 25.x to a supported line. (Node.js security release)
  • PHP: if you haven’t patched yet, do it now, and confirm your WAF rules are blocking rather than just logging. (VulnCheck)
  • Railway: rotate every secret stored in Railway environment variables, and recreate Railway API tokens. (Railway disclosure)
  • Cisco Expressway clusters: upgrade to X15.5.20; there is no workaround. (Cisco advisory)
  • LLM gateways: stop logging full response bodies. They can contain live tokens, which is how LiteLLM was breached. (BerriAI incident post)

AI and agent security3 stories

  • LiteLLM: the tokens came from LiteLLM’s own logs — BerriAI now traces Tuesday’s malicious 1.107.0 release to GitHub CLI tokens the attacker read from the logs of an internet-exposed internal LiteLLM deployment. Claude Code can include a user’s GitHub CLI OAuth token in a response body, and that deployment logged full response bodies. BerriAI found an innocuously named account it hadn’t created there. How the attacker first got in is still unconfirmed: BerriAI only says “a recently patched vulnerability”, without naming the product or a CVE. Branch protection blocked the first attempt, until a token belonging to one of the two GitHub org owners disabled it. Wiz reports about 49,000 downloads of 1.107.0, based on ClickPy data. BerriAI hasn’t confirmed that figure. Wiz also saw stolen AWS role credentials from infected hosts being checked and then used to list Bedrock models within hours, from 168.100.8[.]57 and 165.227.201[.]8.

    • If you installed 1.107.0: rebuild on 1.106.2, rotate everything the host could reach, and search CloudTrail for GetCallerIdentity and Bedrock listing calls from unfamiliar addresses.
    • If you run any LLM gateway: treat its logs as a secrets store. Redact response bodies, keep log and admin UIs internal, audit user accounts, and prefer short-lived tokens.

    (BerriAI incident post, Wiz)

  • Strands Agents A2A server leaked conversations between callers (CVE-2026-115419) — The A2A server in AWS’s Strands Agents SDK didn’t isolate conversation state per caller. One client could read, or steer, another tenant’s conversation history. Upgrade the Python strands-agents package to 1.43.0 or the TypeScript @strands-agents/sdk to 1.5.0. Until then, run one A2A server per tenant. (AWS 2026-146)
    CVSS 8.1 (v3.1, AWS) EPSS not yet scored KEV no

  • OpenCode quietly fixed code execution through malicious MCP servers — Pillar Security found that on Windows and WSL, connecting OpenCode to a malicious remote MCP server over OAuth could run attacker commands. The cause was the third-party open package handing an unescaped URL to PowerShell. It worked even with a normal-looking HTTPS address. OpenCode fixed it in 1.18.33 on 28 September but published no advisory and requested no CVE. Its position is that a malicious MCP server is outside its threat model. Because there is no advisory, dependency scanners won’t flag older versions. Find installs directly, upgrade them, and remove unvetted remote MCP servers. The 9.8 score is Pillar’s own estimate. (Pillar Security, OpenCode releases)

Application security6 stories

  • Node2Shell: Node.js Brotli decoder bug reaches code execution (CVE-2026-111497) — Node’s 21 October security release fixes an out-of-bounds write in its bundled Brotli decoder, reported by OpenAI Codex Security. On 22 October Imperva showed code execution on the official Node 24.22.0 Linux arm64 build; it took several attempts. Apps are exposed when they decompress untrusted Brotli data. Examples are Express 5 and body-parser 2 configured to decode Brotli request bodies, and built-in fetch() reading Brotli responses from servers you don’t control. A bare http server doesn’t decode Brotli bodies by itself. The CVE covers the Brotli library itself (versions 1.0.3–1.2.0, fixed upstream in 1.0.10, 1.1.1 and 1.2.1), so check other software that bundles it. The same release fixes two TLS hostname-check bypasses and a DNS truncation bug, and updates the bundled CA certificates for the eMudhra compromise. 20.x and 25.x are end of life and get no fix. Node rates the Brotli bug High, while the CNA scores it 9.2. (Node.js security release, Imperva)
    CVSS 9.2 (v4.0, Google CNA) EPSS not yet scored KEV no

  • PHP2Shell: a reliable exploit now exists, and still no confirmed compromise — VulnCheck built a working RCE for CVE-2026-109618 on x86-64 with ASLR enabled and display_errors off. It works against PHP 8.4.10–8.4.26; ARM64 doesn’t work yet. VulnCheck also found one public PoC that only works against 8.4.26 in one exact setup. Sophos first reported a successful attempt to deliver the Mirai variant “Potassium”, then corrected itself the same day: the payload never arrived. Sophos names 45.198.224[.]169 as the source. VulnCheck, Sophos and Wordfence see only failed attempts, while Amazon describes broad exploitation. VulnCheck counts about 2.61M internet-facing PHP hosts, about 42% of them on end-of-life branches with no official fix. Treat the “34.4M exposed” figure as unverified: Censys’s own pages show different numbers. Cloudflare’s managed WAF rules have been live since 21 October, including on the Free plan. Make sure they’re in block mode. (VulnCheck, Sophos)
    CVSS 9.2 (v4.0, PHP) / 9.8 (v3.1, NVD) EPSS 0.053 / 0.058 (~93rd pct) KEV no

  • Laravel TokenGuard lets an attacker sign in as another user on MySQL (CVE-2026-114509) — Laravel’s built-in token auth driver accepts a credential that isn’t a string. On MySQL and MariaDB, that can match another user, so an attacker without a token can take over accounts on routes using that guard. Sanctum and Passport aren’t affected. The fixes, 12.68.0 and 13.29.0, shipped quietly in August, and the advisory only went out on 19 October. Check config/auth.php for 'driver' => 'token' and upgrade. Older branches have no listed fix. (GHSA-f9x3-7vq9-cph6)
    CVSS 9.2 (v4.0, GitHub) EPSS 0.00403 KEV no

  • QPACK “Header Accordions”: small HTTP/3 requests exhaust server memory — FoxIO found that 7 of the 10 HTTP/3 stacks it tested don’t cap decoded header size, or cap it too late. An unauthenticated client can make the server allocate far more memory than the request size. Fixes:

    • quic-go: 0.57.0
    • Cloudflare quiche: 0.29.3
    • lsquic: 4.9.0 (CVE-2026-115482, 7.5)
    • Wireshark: 4.6.2 and 4.4.12

    Still unpatched are aioquic/mitmproxy, Bun 1.4.3 and hyperium h3, whose maintainer closed the report. Don’t expose Bun’s HTTP/3 server, turn off HTTP/3 in mitmproxy, and set an explicit max_field_section_size in h3. Google quiche, IIS, ngtcp2/nghttp3 and Envoy aren’t affected. (FoxIO)

  • Eptura Archibus: three bugs chain to unauthenticated code execution — Rapid7 found three flaws in on-prem Archibus versions before 2025.02:

    • an authentication bypass in the DWR API (CVE-2026-107186, 8.6)
    • a workflow rule that reads credential tables (CVE-2026-107187, 8.5)
    • an unrestricted file upload (CVE-2026-107188, 9.6)

    Chained, they give an unauthenticated attacker database secrets and code execution. Upgrade to 2025.02 or later. Eptura says the fix for 2025.01 is still in development. Until you’ve patched, keep Archibus off the internet and look for unexpected uploaded files. Rapid7 doesn’t say whether the hosted service is affected. (Rapid7)
    CVSS 9.6 (v3.1, Rapid7) EPSS 0.00376 KEV no

  • Pillow 13.0.0 replaces a vulnerable bundled OpenJPEG — Pillow’s prebuilt wheels from 11.1.0 through 12.3.0 bundled a libopenjp2 with a heap buffer overflow in JPEG 2000 decoding, reachable through a normal image open. Crashes are confirmed; code execution hasn’t been demonstrated. Pillow detects format by content, not extension, so an upload handler expecting PNG or JPEG can still reach the JPEG 2000 decoder. Upgrade to 13.0.0, and restrict which formats untrusted uploads may decode. The same 17 October batch has about a dozen lower-severity DoS advisories. (GHSA-78g4-xqwv-q3g8)

Exploited and critical CVEs3 stories

  • VeloCloud Orchestrator SQL injection exploited (CVE-2026-114625) — Arista says attackers are exploiting a SQL injection in on-prem VeloCloud Orchestrator. Even the lowest tenant role, Enterprise Read Only, can use it to become a superuser operator. Hosted and dedicated orchestrators are already patched. On-prem owners should move to 5.2.3.18, 6.1.3.10 or 6.4.2.12. Until then, limit web UI access to admin networks, preserve logs, and check for unexpected admin changes, webshells and unusual outbound traffic from the host. Arista lists 74.82.197[.]86 among the addresses to block and hunt for. This is the third exploited VeloCloud Orchestrator flaw since July: CVE-2026-16812 and CVE-2026-93952 are both in KEV. This one isn’t listed yet. (Arista advisory 0199)
    CVSS 9.9 (v3.1, Arista) EPSS not yet scored KEV not yet

  • Cisco Expressway clusters: unauthenticated root command execution (CVE-2026-76466) — On Expressway-C and Expressway-E nodes configured in a cluster with TLS Verify Mode enabled, persistent cookies and weak client-certificate checks let an unauthenticated attacker run commands as root through the database service. Upgrade X15.5.3 and earlier to X15.5.20. X14 and older must migrate, because there is no workaround. No exploitation is known. Expressway-E usually faces the internet, so restrict cluster and database ports to peer nodes until you’ve upgraded. (Cisco advisory)
    CVSS 9.8 (v3.1, Cisco) EPSS 0.0038 KEV no

  • No new KEV entries since 20 October — The catalog is still at version 2026.10.21. Neither the exploited VeloCloud bug nor PHP2Shell is listed yet. Don’t wait for KEV on either. (CISA KEV catalog)

Cloud and infrastructure3 stories

  • Railway: customer environment variables decrypted — Railway disclosed on 21 October that a third party may have accessed encrypted environment variables and obtained the decrypted contents of some of them. It hasn’t said how, or how many customers are affected. It invalidated all API tokens and bucket credentials, reset GitHub tokens and paused builds, which were restored by late 22 October. A preliminary incident report is due. Railway says it believes this is part of a series of attacks on platform companies aimed at AI inference providers. Treat every secret stored in Railway as exposed:

    • rotate API, database, registry and AI-provider keys
    • recreate Railway tokens
    • check connected cloud and AI accounts for unusual use

    Researcher Taylor Monahan has linked about $371k in wallet drains across 19 EVM chains, starting 21 October, to the incident. Railway hasn’t confirmed that link. Move any wallet keys that were ever kept in Railway variables. (Railway disclosure, Railway status page)

  • AWS: SAM CLI command injection, an MQTT DoS, and an Athena fix needing no action — Three AWS bulletins:

    • SAM CLI 1.63.0–1.166.1 (CVE-2026-115414, 7.8): untrusted Terraform config or plan files can inject OS commands during sam build --hook-name terraform. Upgrade to 1.166.2.
    • aws-c-mqtt 0.9.1 to below 0.16.2 (CVE-2026-115417, 7.5): a remote client can trigger excessive memory allocation. Upgrade, and rebuild anything that bundles the C runtime, such as the IoT Device SDK for C++ v2.
    • Athena engine version 3 (CVE-2026-115416): exposed other accounts’ account IDs and SQL text, but not query results. AWS fixed it on 7 October, and there’s nothing to patch.

    (AWS 2026-145, AWS 2026-147, AWS 2026-144)

  • Microsoft fixed two CVSS 10 cloud bugs on its side — On 22 October Microsoft published CVE-2026-97785 in AAD (Entra ID) Application Proxy and CVE-2026-83938 in Azure Kubernetes Configuration Service, both rated Critical. Neither was publicly known or exploited before release, and Microsoft has fully mitigated both. Customers don’t need to do anything. Record them as vendor-remediated in your vulnerability tracking rather than raising tickets. (MSRC CVE-2026-97785, MSRC CVE-2026-83938)

Crypto and Web31 story

  • Fearless Wallet extension leaked private keys for 20 months — The Polkadot Community Foundation says versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 of the third-party Fearless Wallet Chrome extension sent users’ private keys to an outside server when they unlocked the wallet. The code entered the public source in February 2025 inside an unrelated change and was intermittently active until 10 October. Treat the Firefox build as compromised too. The reviewed iOS and Android apps didn’t contain it. Eight users have reported losses totalling 17,286 DOT; a community case log counts slightly less. The foundation hasn’t verified these, and reported dollar figures are press conversions. Updating the extension doesn’t help, because the keys may already be stolen. Create new keys in a different wallet, move funds on every chain, then remove the extension. Report losses to SEAL 911 and ignore “recovery” offers. (Polkadot forum notice)

Incidents and industry4 stories

  • PingCAP: a month-long intrusion took source code and TiDB Cloud customer records — PingCAP says an attacker used stolen service-account credentials from 9 September to 7 October. They copied source code and exported records including names, emails, organisation and cluster IDs, SQL editor text, billing data and encrypted TiDB Cloud API key values. PingCAP reports no evidence that data stored in customers’ TiDB databases was affected, and says it will notify affected customers directly. A group claiming responsibility posts much larger numbers, which are unverified. TiDB Cloud customers should rotate API keys, review access and audit logs back to 9 September, and expect targeted phishing that uses leaked contract details. (PingCAP security update)

  • Andromeda: AI-compute provider’s platform and customer credentials stolen — Andromeda Cluster says it found unauthorised access to its own and some customers’ credentials on 13 October, with activity likely starting around 9 October. It disabled the affected accounts and rotated keys. It found no evidence that customer models, datasets or training data were accessed, and calls the attack part of a wider campaign against AI infrastructure providers. That matches Railway’s wording, but neither company has named an actor. Customers should rotate any keys shared with the platform, notified or not, and check cloud and storage logs from 9 October. (Andromeda security update)

  • Genesys: contact data taken from internal business systems — Genesys found on 16 October that an intruder had accessed and downloaded data from an internal learning system and a CRM. The data covered names, business emails, phone numbers, job titles and account details. It says Genesys Cloud, Engage and customer call data were not affected. The main downstream risk is convincing phishing aimed at Genesys customer admins. Distrust unsolicited “Genesys” credential requests, and check that admin accounts have MFA. (Genesys)

  • City of Columbia, South Carolina takes services offline after a network intrusion — The city detected suspicious activity on 20 October. It took MyColaSC, online business licensing, Parks & Rec, Planning & Development, GIS and Animal Services offline, with no restoration timeline. Police, fire, 911, Columbia Water and payments are running, and the state police agency SLED is investigating. The city hasn’t said whether this is ransomware or whether data was taken, and no group has claimed it. Residents should treat any “MyColaSC” payment or login message with suspicion while the service is down. (City of Columbia)

Bottom line

  1. Exploitation and KEV are out of step again. VeloCloud is confirmed exploited and PHP2Shell now has a reliable exploit, but neither is in KEV yet. Act on vendor statements, not catalog listings.
  2. Secrets keep leaking from places people don’t think of as secret stores: gateway response logs at LiteLLM, platform environment variables at Railway, and exported tables at PingCAP. Inventory where tokens get written, not just where they’re issued.
  3. Quiet fixes are a scanner blind spot. OpenCode shipped one with no advisory, and Laravel’s fix sat in a release for two months before the advisory appeared. Track versions directly for tools your teams use.