Oct 23: Arista patches second VeloCloud Orchestrator zero-day exploited in attacks

Arista patches second VeloCloud Orchestrator Zeroday exploited in attacks.

Arista fixed a privilege escalation flaw in VeloCloud Orchestrator that is already being exploited.

Any authenticated user can gain operator privileges and impersonate a local superuser operator.

Orchestrators manage SD-WAN fleets, so a compromise gives broad control over branch and site connectivity.

Patch now and review operator accounts and audit logs for unexpected superuser activity.

php-2 shell exploitation reaches millions of attempts with attackers dropping mirai mass exploitation of c v e twenty twenty six a hundred nine thousand six hundred eighteen began on october twenty one shortly after the emergency phphp patches Attackers are trying to deploy Mirai malware.

This is the escalation of the PHP RCE flaws we covered yesterday.

Treat any unpatched, internet-facing PHP host as a target, including embedded devices and appliances that bundle PHP host as a target.

Including embedded devices and appliances that bundle PHP.

Critical X42's DK flaw lets malicious APIs drain AI agents' token balances.

The default client in the X42 payment SDK set no spending limit, so a malicious API could charge an autonomous agent for far more than intended.

Releases from August 18 added a limit.

Anyone running agents that pay for API calls should upgrade and set explicit per-request and per-session spending caps.