Daily cybersecurity headlines in plain English from Emmanuel Marquez (@cybermarquez).https://cybermarquez.com/https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/A critical SQL injection bug in on-prem VeloCloud Orchestrator lets a logged-in low-privilege user escalate and take over the SD-WAN management host. It's already being exploited, so patch fast.Thu, 22 Oct 2026 00:00:00 GMTzero-daypatchnetworkinghttps://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/https://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/Attackers got into Capcom's membership service and pulled email addresses, login metadata, and last-used IPs for over 11.7 million accounts. Capcom says passwords and payment cards weren't exposed, but expect targeted phishing.Thu, 22 Oct 2026 00:00:00 GMTbreachgaminghttps://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/An integer overflow in GitLab's regex compiler could let an unauthenticated attacker run code on the server. Fixes are out across supported CE and EE branches, and self-hosted admins should update right away.Thu, 22 Oct 2026 00:00:00 GMTpatchrcedevopshttps://therecord.media/africa-cybercrime-interpol-arrestshttps://therecord.media/africa-cybercrime-interpol-arrestsOperation Serengeti III hit fraud, ransomware, and BEC crews in 20 African countries, knocking out nearly 11,000 malicious networks and recovering over $105 million. Investigators tied the gangs to more than $385 million in victim losses.Thu, 22 Oct 2026 00:00:00 GMTlaw-enforcementcybercrimehttps://www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware/https://www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware/Attackers compromised LiteLLM's release process and shipped a malicious version 1.107.0 to PyPI and Docker that steals credentials and environment variables. Anyone who pulled that build should treat their secrets as burned.Thu, 22 Oct 2026 00:00:00 GMTsupply-chainaimalwarehttps://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.htmlhttps://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.htmlNode.js shipped fixes for 10 flaws, the worst being a bundled Brotli decompression bug that could lead to code execution, including via fetch() on compressed responses. Update to 22.23.4, 24.22.1, or 26.12.1; version 20 and older get no fix.Thu, 22 Oct 2026 00:00:00 GMTpatchrcenodejshttps://www.bleepingcomputer.com/news/security/railway-warns-devs-to-rotate-secrets-after-potential-breach/https://www.bleepingcomputer.com/news/security/railway-warns-devs-to-rotate-secrets-after-potential-breach/Cloud host Railway spotted suspicious activity on the systems that store customer environment variables, and some of those may have been decrypted by an intruder. If you deploy there, rotate your API keys and database credentials now.Thu, 22 Oct 2026 00:00:00 GMTbreachcloudcredentialshttps://isc.sans.edu/podcastdetail/10144https://isc.sans.edu/podcastdetail/10144A scripting mistake during a key ceremony left eight of eMudhra's intermediate CA keys just one byte long, so they've been revoked. Browsers already reject them, but apps with their own certificate bundles may need an update.Wed, 21 Oct 2026 00:00:00 GMTpkihttps://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/https://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/Researchers published a working exploit for a FortiSIEM path traversal flaw that was patched on October 13. If you haven't updated, block the exposed gRPC port until you do.Wed, 21 Oct 2026 00:00:00 GMTpatch nowsiemhttps://cybermarquez.com/news/2026-10-21-php-critical-rce-patch/https://cybermarquez.com/news/2026-10-21-php-critical-rce-patch/PHP pushed out patches early for two critical flaws that can let attackers run code on a huge chunk of the web. Exploits are already floating around, and older PHP versions aren't getting the fix, so upgrade now.Wed, 21 Oct 2026 00:00:00 GMTpatch nowwebhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293ahttps://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293aA joint advisory breaks down SafePay, one of 2026's busiest ransomware crews with around 600 victims. They mostly get in through stolen or guessed passwords and unpatched VPNs and firewalls.Wed, 21 Oct 2026 00:00:00 GMTransomwarehttps://www.oracle.com/security-alerts/cpuoct2026.htmlhttps://www.oracle.com/security-alerts/cpuoct2026.htmlOracle's quarterly Critical Patch Update is a monster this time. E-Business Suite shops should move fast, since details on a SQL injection bug there are already being teased.Tue, 20 Oct 2026 00:00:00 GMTpatch