THREAT INTELLIGENCE BRIEF·Saturday, October 24, 2026·Generated summary

Executive brief

The most urgent threat is an actively exploited SQL injection vulnerability (CVE-2026-114625) in VeloCloud Orchestrator, which is listed on the CISA KEV catalog and requires immediate patching. Additionally, a set of critical remote code execution (RCE) vulnerabilities in PHP, dubbed PHP2Shell, are under active exploit attempts and have a high probability of exploitation, with public exploit code widely available. Further RCE flaws in widely deployed libraries for Python (Pillow) and Node.js (Brotli) also present a significant risk and warrant attention. A fifth concern is a separate, unpatched RCE in PHP for which mitigations are available.

42 articles analysed6 CVEs mentioned

Threat Categories

Vulnerabilities5

Article Analyses (5)

CVE-2026-114625: Actively Exploited VeloCloud Orchestrator Flaw Grants Superuser Access

high

CVE-2026-114625

KEVEPSS 0.6%

Details

CVE-2026-114625 is a critical SQL injection vulnerability in VeloCloud Orchestrator. The flaw allows an authenticated user to gain superuser operator privileges, effectively taking full control of the device.

Affected Systems

VeloCloud Orchestrator

Potential Impact

A successful exploit could lead to a complete compromise of the network orchestration platform, allowing an attacker to manipulate network traffic, bypass security controls, and gain access to sensitive data across the managed network.

Mitigations

This vulnerability is under active exploitation. Per CISA's directive, all federal civilian executive branch agencies must patch this vulnerability by the due date of 2026-10-26. All organizations using the affected product should apply vendor patches immediately.

SOC Radar Draft Post

[CRITICAL] "PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware"

critical

CVE-2026-109618 CVE-2026-109619

EPSS 11.6%PoC

Details

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, can allow an unauthenticated attacker to achieve remote code execution on affected web servers. Threat actors are actively attempting to exploit these flaws at scale to deploy variants of the Mirai botnet malware.

Affected Systems

PHP running on various web server configurations.

Potential Impact

Compromise can lead to server takeover, integration into a botnet for DDoS attacks, data theft, or use as a pivot point for further intrusion into the network.

Mitigations

Apply the emergency patches released by the PHP project immediately. Monitor web server logs for signs of exploit attempts. The availability of public PoC code increases the urgency for patching.

The Hacker News Draft Post

[CRITICAL] "Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data"

critical

CVE-2026-111497

EPSS 0.5%PoC

Details

A vulnerability (CVE-2026-111497) in the Brotli decoder bundled with official builds of Node.js can be exploited to achieve remote code execution. Researchers have created a proof-of-concept, named Node2Shell, demonstrating that feeding specially crafted Brotli data to an application can trigger the flaw.

Affected Systems

Official builds of Node.js, specifically tested on version 24.22.0 for Linux arm64.

Potential Impact

Successful exploitation could allow an attacker to run arbitrary code on the server running the Node.js application, leading to a full system compromise.

Mitigations

Update to the latest patched version of Node.js. Given that public exploit code is available, systems running vulnerable versions should be considered at high risk.

The Hacker News Draft Post

[CRITICAL] "Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image"

critical

CVE-2026-112900

EPSS 0.4%

Details

A critical vulnerability, CVE-2026-112900, exists in the widely used Pillow image processing library for Python. The flaw occurs when handling EPS image files; the library passes the filename to the Ghostscript program without proper sanitization, which can be abused to execute arbitrary operating system commands.

Affected Systems

Python applications using the Pillow library to process EPS images.

Potential Impact

An attacker could craft a malicious image file that, when processed by a vulnerable application (e.g., a web server that resizes user-uploaded images), would execute code on the server, potentially leading to a full compromise.

Mitigations

Update the Pillow library to the latest patched version. If immediate patching is not possible, consider disabling the processing of EPS files or implementing strict input validation on filenames.

The Hacker News Draft Post

[CRITICAL] "PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches"

critical

CVE-2026-115560

Details

A new remote code execution vulnerability, CVE-2026-115560, has been disclosed in PHP. This flaw is distinct from PHP2Shell and currently has no patch. It affects only web applications configured in a specific, non-default manner.

Affected Systems

PHP applications with a specific, non-default server configuration.

Potential Impact

Although the attack scenario is considered unlikely by the PHP project, a successful exploit would result in remote code execution on the web server.

Mitigations

As there is no patch, the PHP project recommends implementing the specific mitigation measures provided, which involve disabling a particular feature. Review server configurations to determine if they are vulnerable and apply the recommended changes.

The Hacker News Draft Post

Generated by gemini-2.5-pro