cybr.cx | Daily Digest — October 25, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-114625 | Arista VeloCloud Orchestrator | CVSS: N/A
A SQL injection vulnerability in Arista's VeloCloud Orchestrator on-premises deployment is being actively exploited in the wild, with CISA's remediation deadline already passed (October 26). Successful exploitation gives attackers access to privileged internal functionality and full control over the orchestrator host — confidentiality, integrity, and availability are all at risk. If you run on-prem VCO, assume compromise is possible and prioritise patching or isolation immediately.

⚠️ Actively exploited — CVE-2026-110447 | Collabora Online (Built-in CODE Server) / Nextcloud | CVSS: N/A
An OS command injection vulnerability in Collabora's built-in CODE Server triggers when the CODE server process isn't running — a condition that can be induced or timed by an attacker. Exploitation achieves remote code execution on the host, and the attack surface includes any Nextcloud instance bundling the affected CODE Server plugin. Organisations running self-hosted Nextcloud with Collabora integration should patch or disable the integration until updated packages are deployed.

⚠️ Actively exploited — CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition | CVSS: N/A
An OS command injection flaw in SiteGuard Server Edition allows attackers to execute arbitrary commands with root or SYSTEM privileges. CISA's remediation deadline has already passed (October 23). SiteGuard is deployed as a WAF/IDS layer on web servers, making exploitation here particularly ironic — your perimeter defence becoming the entry point.

⚠️ Actively exploited — CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 | Plex Media Server | CVSS: N/A
Four vulnerabilities in Plex Media Server are being actively exploited as a chain. CVE-2026-96652 allows any X-Plex-Token holder to force the server to POST to arbitrary destinations via the protocol parameter (SSRF). CVE-2026-96655 adds a second SSRF vector through the transcode path. CVE-2026-96654 allows encoded URI scheme injection to invoke arbitrary plugin functions. CVE-2026-96656 caps the chain with arbitrary file write executable on load. Together, these provide a clear path from network access to code execution — Plex users should patch immediately, and administrators should audit token exposure.

⚠️ Actively exploited — CVE-2026-110936 | Siemens Software Center | CVSS: N/A
An uncontrolled search path element vulnerability allows an authenticated local attacker to plant a malicious DLL in a directory searched by Siemens Software Center, resulting in arbitrary code execution at the application's privilege level. While local access is required, this is a realistic post-initial-access escalation step in OT/ICS environments where Siemens tooling is common. Patch or restrict write access to affected directories.

CVE-2026-110018 | aBlocks WordPress Plugin (≤2.17.0) | CVSS: 8.8 — HIGH
The aBlocks Gutenberg plugin exposes a REST endpoint (/ablocks/v1/form-builder/registration) with permission_callback => __return_true, meaning any unauthenticated request can trigger user registration logic and escalate privileges. WordPress site owners running aBlocks should update immediately and audit user accounts for unexpected registrations.

CVE-2026-116009 | Camaleon CMS (<2.9.3) | CVSS: 8.8 — HIGH
A path traversal flaw lets users with only media permissions write arbitrary files by slipping ../ sequences into the name parameter. The exploit path is particularly nasty: an attacker sends a base64-encoded data: URI to the crop_url action to drop a malicious ERB template into a theme's views directory, which executes server-side when rendered. Update to 2.9.3 or later.

CVE-2026-116019 | Grav CMS 2.0.15–2.2.12 | CVSS: 8.8 — HIGH
Grav's allowlist for static method invocation can be bypassed by page editors using unset-name@ or integer keys to relocate data-*@ directives in Flex form overrides embedded in page frontmatter. The result: a user with only page-edit permissions can call arbitrary public static methods, including Folder::delete or Utils::download, enabling directory deletion and file overwrites. Upgrade to 2.2.13.

CVE-2026-116014 | open62541 OPC UA Library (1.5.0–1.5.6) | CVSS: 8.1 — HIGH
A 16-bit integer overflow in UA_DataType_fromStructureDescription() can be triggered by a malicious OPC UA server supplying crafted DataType definitions to a connecting client, causing a heap overflow in decodeBinaryStructure(). Impact ranges from client crash to potential code execution — significant in industrial environments where open62541 underpins OPC UA clients. Patch to 1.5.7.

Headline News

The http2shell / PHP RCE: AI Finds What Years of Audits Missed

A critical remote code execution vulnerability in PHP — affecting an estimated 70% of web servers running the language — was surfaced through AI-assisted security research before widespread exploitation could take hold, though that window closed quickly once details began leaking publicly. The flaw, dubbed "http2shell" or "php2shell" in researcher circles, allows attackers to achieve shell execution via crafted HTTP/2 requests handled by vulnerable PHP configurations, and it affects not just PHP but interacts with shared HTTP/2 handling components in Node.js and Python environments as well. Within days of the initial disclosure, attempted exploitation surged globally, forcing governments and large organisations into emergency patching cycles. The story is as much about the detection method as the bug itself: an OpenAI model identified the vulnerability pattern during routine code analysis, raising genuine questions about how many similar flaws are sitting in widely-deployed codebases that only AI-scale analysis will surface. Practitioners should verify PHP versions and HTTP/2 configurations across their stacks immediately and monitor for exploitation indicators at the web layer.

Knicks Championship Ring Phishing Test Backfires Spectacularly

Madison Square Garden's security team sent employees what appeared to be an email offering them options to select a New York Knicks championship ring — a highly believable lure given the team's recent title — but the email was actually an internal phishing simulation. More than 275 players and staff received the message, and while the intent was presumably to test security awareness, the exercise generated significant internal backlash when employees realised the ring offer was fabricated. MSG has since called it an "unfortunate mistake," which is a curious description for what was apparently a deliberate security test rather than an accidental send. The incident is a useful case study in the ethics and optics of phishing simulations: the more convincing the lure, the more effective the test — and the more damage it can do to employee trust and morale when the reveal lands poorly. Security teams designing simulation programmes should weigh the realism-versus-resentment tradeoff carefully, particularly when the bait involves significant personal rewards.

Crime Stoppers Data Breach Exposes 1.5 Million Canadian Tips

The Winnipeg Police Service has suspended its use of Crime Stoppers after an investigation revealed a data breach that exposed more than 1.5 million tips submitted across Canada — an extraordinary leak from a platform whose entire value proposition is anonymity for informants. The breach's scope suggests systemic data handling failures rather than a targeted intrusion against a single jurisdiction, and the implications extend far beyond Winnipeg to every Canadian who submitted tips believing their identity was protected. For practitioners, this highlights the acute risk of legacy anonymous reporting infrastructure: systems designed pre-GDPR, often under-resourced, frequently holding highly sensitive human intelligence data with inadequate security controls. The real-world consequences here aren't just regulatory — informants whose identities could be inferred from tip content face potential physical danger.

Schrödinger's Feed

A NowSecure study of over 136,000 mobile applications found that 97% lack any implementation of Post-Quantum Cryptography — a striking number given that NIST PQC standards have been finalised and mandated timelines are already in motion. The root cause isn't ignorance so much as infrastructure: most apps rely on third-party SDKs and compiled libraries that traditional SAST tools can't fully inspect, meaning the "mobile PQC gap" is largely invisible to conventional security scanning. The threat model here isn't theoretical — sufficiently capable quantum adversaries could retroactively decrypt traffic captured today, and mobile apps handling authentication tokens, health data, or financial transactions are obvious targets. Practitioners responsible for mobile security programmes should be auditing their SDK dependency chains now, not waiting for the deadline pressure to arrive.

/dev/random

The security and economics communities are apparently converging on the same uncomfortable observation: despite staggering AI investment, productivity gains remain stubbornly confined to the tech sector itself. Apollo's analysis finds no measurable payoff in the broader economy — manufacturing, healthcare, logistics — where the transformative promises were loudest. For security teams who've spent the last two years being sold AI-powered everything, this is either validating or concerning depending on whether your vendor's product actually works. The one confirmed AI productivity win this week, ironically, was finding a critical RCE vulnerability affecting 70% of the web — which suggests the technology is performing best when pointed at code, not quarterly earnings.