Weekly Brief
exploited flaws, edge device intrusions and AI abuse
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
CISA added two critical flaws in Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities list after reports of active exploitation. That makes them immediate patch-or-mitigate items for defenders with either product exposed.
Check whether Collabora CODE Server or Arista VeloCloud Orchestrator are in your environment, then prioritise containment, patching and exposure review today.
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Researchers said a large campaign targeted exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect devices and exposed more than 70,000 credentials. The activity shows how quickly edge-device compromise can turn into wider access across organisations.
Review all internet-facing VPN and firewall appliances for signs of compromise and rotate credentials that may have passed through those devices.
PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
Attackers were observed using the PHP2Shell flaws, tracked as CVE-2026-109618 and CVE-2026-109619, and then using AI platforms for post-exploitation activity. In one case, a European government entity was accessed within two hours, including password hashes and multi-factor-related data.
Hunt for signs of PHP2Shell exploitation on externally reachable PHP systems and review any post-exploitation access to hashes, tokens or MFA data.
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Attack attempts against PHP2Shell also appeared at scale as actors tried to use the flaws to deploy Mirai malware. The reporting suggests the bugs are being widely probed even where reliable weaponisation may still be difficult.
If you run exposed PHP services, validate whether you are affected, apply the published fixes where available, and monitor for exploit scans and botnet activity.
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A Brotli decoder memory-corruption flaw, CVE-2026-111497, affects software that unpacks Brotli-compressed data, including Bun, Python packages and Envoy setups. Crafted data can corrupt memory and has already been shown to trigger code execution in Node.js.
Inventory services that decompress Brotli data and update affected runtimes and libraries, especially Node.js, Bun, Python packages and Envoy.
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
A UEFI bootkit named BlackX used the Baton Drop flaw to bypass Secure Boot and load a malicious driver designed to interfere with security products. The case shows that firmware-level compromise can survive normal OS defences and undermine endpoint controls.
Check whether Secure Boot revocations are current on Windows systems and verify that firmware protections and endpoint tamper controls are enforced.
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
LiteLLM disclosed that a master key posted to a public GitHub repository let an attacker steal GitHub tokens and hijack its release pipeline. The incident is a reminder that a single leaked secret can become both source-code access and supply-chain compromise.
Search repositories and CI logs for exposed secrets, then rotate any API keys, GitHub tokens and pipeline credentials that could have been committed publicly.
Railway warns devs to rotate secrets after potential breach
Railway warned users to rotate secrets after detecting suspicious activity on systems that store customer environment variables. The issue matters because environment variables often hold production credentials that can be reused elsewhere if exposed.
Rotate secrets stored in platform environment variables and review audit logs for unusual access to secret stores or deployment settings.