cybr.cx Daily Digest — October 27, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-114625 | Arista VeloCloud Orchestrator | No CVSS listed
A SQL injection vulnerability in Arista's VeloCloud Orchestrator (on-premises deployments) allows remote, unauthenticated attackers to access privileged internal functionality, potentially compromising the full confidentiality, integrity, and availability of the orchestrator and its managed data. CISA's remediation deadline has already passed (October 26) — if you're running VCO on-prem and haven't patched, treat this as an active incident response situation.

⚠️ Actively exploited — CVE-2026-110447 | Collabora Online (Built-in CODE Server) / Nextcloud | No CVSS listed
When the integrated CODE server is not running inside a Nextcloud deployment, an OS command injection path opens that enables remote code execution. This is a particularly nasty configuration-dependent trigger: environments that have temporarily stopped the CODE service are silently vulnerable. Patch or disable the integration entirely until remediated.

⚠️ Actively exploited — CVE-2026-96652 / 96654 / 96655 / 96656 | Plex Media Server | No CVSS listed
Four Plex vulnerabilities are being chained in active exploitation, combining SSRF (via the /video/:/transcode/universal path and the protocol parameter), encoded URI scheme injection for cross-plugin parameter manipulation, and arbitrary file write exploitable at server load. Any X-Plex-Token — including low-privilege ones — can initiate the SSRF chain. Plex instances exposed to any network segment should be patched immediately; remediation deadlines for the file-write and URI injection components have already passed.

⚠️ Actively exploited — CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition | No CVSS listed
An OS command injection flaw permits execution of arbitrary commands with root or SYSTEM privileges. Deadline passed October 23. If SiteGuard is in your WAF stack, this is your top priority today.

⚠️ Actively exploited — CVE-2026-110936 | Siemens Software Center | No CVSS listed
An uncontrolled search path element vulnerability lets an authenticated local attacker drop a crafted DLL into a directory searched by the application, resulting in arbitrary code execution at the application's privilege level. Deadline is November 3 — don't sit on this one given active exploitation.

CVE-2026-116237 | Oray Pugongying X5 Pro 7.6.1 | CVSS 8.4 (High)
A CRLF injection vulnerability in the Dnsmasq component of this network device is remotely exploitable, and a public exploit now exists. The vendor has not responded to disclosure. CRLF injection in DNS infrastructure can enable response manipulation and log poisoning — treat unpatched units as untrusted.

CVE-2026-116116 | Yoosee GM8135S Camera 21.00.01.36 | CVSS 8.2 (High)
Improper verification of cryptographic signatures in the Secure Boot implementation means an attacker with local access can bypass boot integrity checks entirely. A public exploit is available and the vendor has not responded. IoT cameras with physical or network-accessible console interfaces should be isolated.

CVE-2026-112343 | Syncplify Server! before 8.8.0 | CVSS 8.1 (High)
Authenticated SFTP users can bypass per-path permission overrides by addressing protected directories using alternate capitalisation or Windows 8.3 short names, exploiting case-insensitive filesystem resolution. The practical result: users restricted from specific paths can trivially read and write them anyway. Upgrade to 8.8.0.

CVE-2026-116218 | Dolibarr ERP CRM 19.0.0–23.0.4 | CVSS 7.6 (High)
An unescaped type field in the third-party bank accounts REST endpoint allows time-based blind SQL injection by any authenticated user with only societe/creer permission — a very low bar. Attackers can extract password hashes and API keys. Upgrade to 23.0.4 and audit API user permissions immediately.

CVE-2026-116543 | Open5GS 1.3.0–2.8.0 | CVSS 7.5 (High)
An unauthenticated attacker can crash any 5G core network function by sending a single crafted multipart/related request with an empty multipart boundary, triggering a heap out-of-bounds write in parse_multipart(). Operators running open-source 5G core infrastructure should treat this as urgent.

Headline News

Unidentified ransomware variant deploys novel CHL3 encryption marker
A new ransomware strain has surfaced in the wild, appending a .locked extension to encrypted files alongside a distinctive CHL3 marker embedded in a structured 93-byte footer. The unusual footer structure — consistent across multiple encrypted drives on affected Windows 11 systems — suggests a purpose-built or heavily modified encryptor rather than an off-the-shelf kit. The CHL3 marker doesn't match any currently catalogued ransomware family in public decryptor databases, complicating recovery efforts for victims. Incident responders encountering this variant should preserve the footer data intact, as the structured metadata may eventually yield clues about the key derivation or escrow mechanism. Until attribution is established, defenders should treat this as a novel threat and not assume existing decryption tools will apply.

Initia blockchain bridge drained to near-zero in targeted attack
A hack against the Initia protocol depleted its USDC bridge reserve to just $63, causing withdrawal failures across the platform as users found their positions effectively frozen. On-chain analysis tied the collapse of exit liquidity directly to the exploit, with the depleted backing exposing a structural dependency between bridge solvency and user fund accessibility. The incident is a sharp reminder that bridge contracts — particularly those managing cross-chain reserve balances — remain among the highest-value targets in the ecosystem, with a single exploit capable of cascading into a full liquidity crisis. A patch and recovery process is reportedly underway, but the episode underscores that bridge architecture review should be continuous, not reactive. Security engineers working on DeFi infrastructure should scrutinise reserve management logic and access controls around bridge contract administration as a priority.

Schrödinger's Feed

Scientists have successfully filmed — for the first time — magnetic vortices known as skyrmions melting out of an organised lattice structure, capturing the dynamics of these exotic quantum objects in real time. Skyrmions are topologically protected spin configurations that can be manipulated at nanoscale, making them compelling candidates for ultra-dense, energy-efficient "neuromorphic" computing architectures. The ability to directly observe and therefore better control their phase transitions is a meaningful step toward engineering stable quantum states in solid-state systems. For practitioners watching the long arc toward quantum-resistant infrastructure: advances in hardware controllability at this level feed directly into the timeline for practical quantum computing, which in turn sets the urgency clock for post-quantum cryptography migration.

/dev/random

It turns out the intellectual father of the bus route was Blaise Pascal — yes, the same seventeenth-century mathematician behind Pascal's Triangle, early mechanical calculators, and the foundational work on probability theory. In 1662, Pascal organised the carrosses à cinq sols: fixed-route, scheduled, shared horse-drawn coaches running through Paris — essentially the world's first public transit network. The system launched successfully, ran for a decade or so, and then quietly died when the routes were restricted to exclude working-class passengers, at which point ridership collapsed entirely in one of history's earliest documented examples of a product failing due to access control misconfiguration. Security professionals will appreciate that the vulnerability was social, not technical, and that the threat actor was the product owner.