Daily brief
Cyber news, minus the noise.
What happened in security, in a couple of sentences. Click through for the full story. RSS
Thursday, Oct 22, 2026
-
Arista patches exploited VeloCloud Orchestrator zero-day
A critical SQL injection bug in on-prem VeloCloud Orchestrator lets a logged-in low-privilege user escalate and take over the SD-WAN management host. It's already being exploited, so patch fast.
read at BleepingComputer → (opens in new tab)- zero-day
- patch
- networking
-
Capcom confirms breach of 11.7 million CAPCOM ID accounts
Attackers got into Capcom's membership service and pulled email addresses, login metadata, and last-used IPs for over 11.7 million accounts. Capcom says passwords and payment cards weren't exposed, but expect targeted phishing.
read at BleepingComputer → (opens in new tab)- breach
- gaming
-
GitLab fixes max-severity remote code execution flaw
An integer overflow in GitLab's regex compiler could let an unauthenticated attacker run code on the server. Fixes are out across supported CE and EE branches, and self-hosted admins should update right away.
read at BleepingComputer → (opens in new tab)- patch
- rce
- devops
-
Interpol crackdown nets 1,462 arrests across Africa
Operation Serengeti III hit fraud, ransomware, and BEC crews in 20 African countries, knocking out nearly 11,000 malicious networks and recovering over $105 million. Investigators tied the gangs to more than $385 million in victim losses.
read at The Record → (opens in new tab)- law-enforcement
- cybercrime
-
LiteLLM release pipeline hijacked to push info-stealer
Attackers compromised LiteLLM's release process and shipped a malicious version 1.107.0 to PyPI and Docker that steals credentials and environment variables. Anyone who pulled that build should treat their secrets as burned.
read at BleepingComputer → (opens in new tab)- supply-chain
- ai
- malware
-
Node.js patches Brotli bug that could allow remote code execution
Node.js shipped fixes for 10 flaws, the worst being a bundled Brotli decompression bug that could lead to code execution, including via fetch() on compressed responses. Update to 22.23.4, 24.22.1, or 26.12.1; version 20 and older get no fix.
read at The Hacker News → (opens in new tab)- patch
- rce
- nodejs
-
Railway tells users to rotate secrets after possible breach
Cloud host Railway spotted suspicious activity on the systems that store customer environment variables, and some of those may have been decrypted by an intruder. If you deploy there, rotate your API keys and database credentials now.
read at BleepingComputer → (opens in new tab)- breach
- cloud
- credentials
Wednesday, Oct 21, 2026
-
Eight eMudhra intermediate certificates revoked over one-byte private keys
A scripting mistake during a key ceremony left eight of eMudhra's intermediate CA keys just one byte long, so they've been revoked. Browsers already reject them, but apps with their own certificate bundles may need an update.
-
Proof-of-concept lands for a FortiSIEM remote code execution bug
Researchers published a working exploit for a FortiSIEM path traversal flaw that was patched on October 13. If you haven't updated, block the exposed gRPC port until you do.
read at Horizon3.ai → (opens in new tab)- patch now
- siem
-
PHP ships an emergency fix for two critical code-execution bugs
PHP pushed out patches early for two critical flaws that can let attackers run code on a huge chunk of the web. Exploits are already floating around, and older PHP versions aren't getting the fix, so upgrade now.
-
CISA and FBI drop a SafePay ransomware advisory
A joint advisory breaks down SafePay, one of 2026's busiest ransomware crews with around 600 victims. They mostly get in through stolen or guessed passwords and unpatched VPNs and firewalls.
read at CISA → (opens in new tab)- ransomware
Tuesday, Oct 20, 2026
-
Oracle's October patch drop fixes 1,295 vulnerabilities
Oracle's quarterly Critical Patch Update is a monster this time. E-Business Suite shops should move fast, since details on a SQL injection bug there are already being teased.