Weekly Report: New Hacking Techniques and Critical CVEs 19 Oct to 25 Oct 2026

1Arista VeloCloud Orchestrator, CVE-2026-114625 (CVSS 9.9). It ranks first because Arista detected the flaw already in active exploitation, there is no configuration that prevents exposure to it, and one compromised orchestrator controls the SD-WAN edges it manages. This is also the third exploited VeloCloud Orchestrator CVE in 87 days. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 and check web access logs for the two attacker IP addresses Arista published.

2Collabora Online built-in CODE server, CVE-2026-110447 (CVSS 9.2). It ranks second because it needs no authentication and exploitation traces back to at least 10 September 2026, so webshells may already be in place. Upgrade the Nextcloud app to the fixed version for your branch, or remove it, then check the web root for unexpected PHP files.

3Plex Media Server, Plex2Shell (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656). It ranks third because the chain runs without valid credentials, a public exploit was released after the 16 October 2026 write-up, and exploitation followed within a day. It sits below the first two only because Plex is less common on enterprise networks. Upgrade to 1.43.3.10861 or later.

What it is: CVE-2026-114625 is a SQL injection (CWE-89) in Arista VeloCloud Orchestrator (VCO) On-Prem that lets any authenticated user, down to the lowest built-in Enterprise Read Only role, gain operator privileges and act as the local superuser operator account.

Affected products and versions: VeloCloud Orchestrator On-Prem 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12. End-of-support versions were not assessed. Hosted and Dedicated VCO were affected and have already been patched by Arista. VeloCloud Edge, VeloCloud Gateway, Arista EOS, CloudVision and Wi-Fi access points are listed as not affected.

Severity: CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, assigned by Arista as CNA); CVSS 4.0 score 9.4.

Exploitation status: Confirmed in the wild. Arista states the vulnerability was detected by Arista and is known to be actively exploited, and it published two attacker IP addresses, 74.82.197.86 and 38.54.50.151. Added to CISA KEV on 23 October 2026. Federal remediation due date 26 October 2026.

Patch status: Fixed in 5.2.3.18, 6.1.3.10 and 6.4.2.12 and later in each train, published in Arista Security Advisory 0199 on 22 October 2026, tracked internally as BUG2043622. Arista states there is no configuration that prevents exposure to this vulnerability, so there is no workaround.

What to do: Upgrade every on-premises VCO to the fixed build for its train. Note that the builds which fixed the July and September VeloCloud flaws are older than these, so an orchestrator patched for those is still vulnerable to this one. Until you can upgrade, restrict the web interface to trusted administrative networks. Search VCO web access logs for the two published IP addresses, encoded characters and references to internal services, and preserve logs and file-system timestamps before remediating.

Why it matters: An orchestrator pushes configuration to every SD-WAN edge it manages, so CVE-2026-114625 turns one low-privilege tenant login into control of the branch network. This is the third exploited VeloCloud Orchestrator flaw since 27 July 2026, after CVE-2026-16812 and CVE-2026-93952, which makes the VCO portal a recurring target rather than a one-off and puts it firmly in your inventory of internet-facing management interfaces.

What it is: CVE-2026-110447 is an unauthenticated OS command injection (CWE-78) in proxy.php of the Collabora Online built-in CODE server (the richdocumentscode Nextcloud app). The script starts the bundled Collabora server when a request arrives and nothing is listening, and in vulnerable versions it placed the request path inside a double-quoted shell command, so a command hidden in the path runs as the web server user.

Affected products and versions: richdocumentscode before 26.4.303, and affected even when the app is disabled. The flaw is reachable only while the built-in CODE server is stopped, for example after a container restart, upgrade or crash. Standalone Collabora Online servers, Collabora Docker images, RPM and DEB packages, and Nextcloud All-in-One deployments are not affected.

Severity: CVSS 9.2 (CVSS 4.0, Critical). No CVSS 3.1 score has been assigned.

Exploitation status: Confirmed in the wild. Server logs posted by affected administrators to the project’s GitHub issue tracker show the earliest exploit request at 19:51:52 on 10 September 2026 (UTC+2), followed by webshells with names such as shx5cf91.php. Added to CISA KEV on 23 October 2026. Federal remediation due date 26 October 2026.

Patch status: Fixed in 26.4.303, and in 26.4.402 and 26.4.502 for Nextcloud 30 and newer. The advisory was published on 14 October 2026. Some administrators reported start-up problems on 26.4.402 in mid-October and rolled back to 26.4.303. Nextcloud 29 and earlier are end-of-life, so administrators on those versions must upgrade Nextcloud or remove the app.

What to do: Run occ app:update richdocumentscode to reach the fixed version for your branch, or remove the app; disabling it does not close the flaw. Then run occ integrity:check-app richdocumentscode, since a failed integrity check is how at least one operator first noticed. Search the app tree for dropped files matching sh[xr]*.php, and grep access logs from 10 September 2026 for requests to proxy.php?status containing $(, %24%28 or ${IFS}. If you find a webshell, treat the server as compromised and rotate every credential the web server account could read.

Why it matters: Nextcloud often holds an organisation’s shared files and the credentials that sync them, so a webshell on that host gives an attacker both data and a foothold. Because the flaw only fires when the CODE server is down, a routine restart can reopen the window on an unpatched server, and the app is vulnerable even when disabled.

What it is: CVE-2026-109618 is remote code execution through out-of-memory corruption during request cleanup, and CVE-2026-109619 is remote code execution through stale request-owned global state reused by a later request on the same worker. Together they are known as PHP2Shell, and PHP states both can allow unauthenticated remote code execution.

Affected products and versions: PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12, across PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP says all installations serving web requests are at risk. PHP 8.1 and older receive no updates from the project; minimal source backports were published for 7.4, 8.0 and 8.1. Releases as far back as PHP 5.4 contain at least one of the flaws.

Severity: CVSS 9.2 (CVSS 4.0) for both, assigned by the PHP Group as CNA.

Exploitation status: Public proof-of-concept code, no confirmed successful compromise as of 25 October 2026. watchTowr reproduced CVE-2026-109618 and Datadog reproduced the out-of-memory corruption on PHP 8.5.11 with an unauthenticated POST. Multiple public exploit frameworks have since appeared. Sophos reported public PoC code on 22 October 2026 and at 21:21 UTC the same day withdrew an earlier report of a successful compromise, citing scanning and a small number of failed attempts. The Cyber Security Agency of Singapore reports widespread exploitation attempts. Not in CISA KEV as of 25 October 2026.

Patch status: Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released 21 October 2026. The PHP project states the available mitigations are not complete fixes. Two days later, on 23 October 2026, PHP published a separate advisory for CVE-2026-115560, a configuration-dependent RCE risk in session upload progress involving a serialize handler mismatch. It is a different mechanism and not a bypass of the 21 October fixes, and PHP says a full advisory will accompany the next regular release.

What to do: Inventory every host running PHP, including servers where only a third-party component uses it and bundled binaries inside appliances and hosting panels, then upgrade the internet-facing ones first. On 8.1 and older, apply the project’s source backports or a vendor-supported build. Where you cannot patch today, the partial mitigations are session.upload_progress.enabled = 0, memory_limit = -1, fatal_error_backtraces = 0 on PHP 8.5, and lower post_max_size and upload_max_filesize values. None is a fix. Alert on PHP worker processes spawning child processes, and watch for unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses and unusually large PHPSESSID cookies.

Why it matters: Wiz, which found the flaws alongside Ryan Austin of Calif working through OpenAI’s Patch the Planet project, puts the exposure at roughly 70 percent of the internet, and demonstrated pre-authentication code execution against WordPress, Drupal and Joomla without relying on application code. The discovery is itself notable: Wiz credits frontier models with finding the flaw, developing the exploit and validating the patch, on memory-safety bugs that survived more than a decade of human review. That puts every PHP-backed web application on your external surface in scope at once, which is a different patching problem from a single appliance.

What it is: CVE-2026-110264 is an integer overflow in GitLab’s regular expression compiler that could allow an unauthenticated user, under certain circumstances, to execute arbitrary code on the GitLab server by submitting a specially crafted regular expression.

Affected products and versions: GitLab Community Edition and Enterprise Edition, self-managed, from version 7.0 onward. That covers roughly 12 years of releases, though there is no evidence of exploitation across that period. GitLab.com is already patched, and GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later need no action.

Severity: CVSS 10.0 (CVSS 3.1, Critical, assigned by GitLab as CNA). It is the only critical item among 12 CVEs in the same release.

Exploitation status: No exploitation reported as of 25 October 2026. The flaw was reported to GitLab by the researcher joaxcar through its HackerOne bug bounty programme. Not in CISA KEV.

Patch status: Fixed on 21 October 2026 in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. Only 19.5.1, 19.4.3 and 19.3.6 fix all 12 CVEs in the release; the backports to 19.2.9, 19.1.9, 19.0.10 and 18.11.13 carry the critical fix alone. GitLab 18.10 and older have no fixed release and need a move to a supported line.

What to do: Upgrade self-managed instances immediately, and plan the window: 19.3.6 and 19.4.3 contain regular migrations, and 19.4.3 also carries a post-deploy migration. GitLab published two detection rules for self-managed instances, covering an Onigmo native worker crash and an Org mode render error burst, so review those for signs of attempted exploitation. While you are in the release, note CVE-2026-15723 (CVSS 8.2), which allows an authenticated user to take over an LDAP-backed account where OmniAuth-SAML and LDAP auto-linking are both enabled.

Why it matters: A self-managed GitLab server holds source code, CI secrets, deployment credentials and signing keys, so unauthenticated code execution there is closer to a full environment compromise than to a single application flaw. This is also GitLab’s second CVSS 10.0 regular expression compiler bug in ten days, after CVE-2026-97229 on 12 October, which suggests the component is under sustained scrutiny and worth watching beyond this patch.

What it is: CVE-2026-96656 is code execution through an unsigned codec load in the Plex transcoder’s codec directory. Chained with the SSRF flaws CVE-2026-96652 and CVE-2026-96655 and the URI injection flaw CVE-2026-96654, it lets a remote attacker with no valid credentials execute code as the Plex service account. Security researcher Zach Main, who publishes as ZM, named the chain Plex2Shell.

Affected products and versions: Plex Media Server before 1.43.3.10861; fixed in 1.43.3.10861. Plex’s own September 2026 notice described the affected range as 1.43.2 and earlier, and the public exploit targets 1.43.3.10828 and older, so use 1.43.3.10861 as the minimum safe build.

Severity: CVSS 8.6 for CVE-2026-96656 (CVSS 4.0, assigned by CISA as CNA), 7.2 under CVSS 3.1. That CVE requires administrator access, and the three medium-rated flaws are what hand it over. The other three score between 5.3 and 6.9 under CVSS 4.0. The researcher scores the full chain at CVSS 9.8, which is not a CNA score.

Exploitation status: Confirmed in the wild, with a public PoC at github.com/code-zm/plex2shell. Plex confirmed active and widespread exploitation on 19 October 2026. The honeypot operator boredhackerblog documented exploitation on 17 October 2026, one day after the write-up, delivering the XMRig cryptominer and proxy malware. All four CVEs added to CISA KEV on 20 October 2026. Federal remediation due date 23 October 2026 for CVE-2026-96654 and CVE-2026-96656, and 3 November 2026 for CVE-2026-96652 and CVE-2026-96655.

Patch status: Fixed in Plex Media Server 1.43.3.10861. Zach Main reported the chain to Plex on 27 July 2026, Plex confirmed and awarded a bounty on 4 August, shipped the fix and emailed server owners on 1 September, the CVEs were published on 23 September, and the write-up followed on 16 October 2026.

What to do: Inventory every Plex Media Server by scanning for TCP 32400 and the Plex Media Server process across servers, NAS boxes and staff lab machines, and record the version. Upgrade everything to 1.43.3.10861 or later, including servers on staff home networks that connect to corporate resources, and remove Plex from any internet-exposed corporate host. Check for unexpected shared objects in the transcoder codec directory, and block the reported miner infrastructure, including the domain ota.proxystream[.]st.

Why it matters: The first step of the chain accepts any value in the X-Plex-Token header, so an attacker needs nothing but network reachability to start. Plex is one of the few server products households deliberately expose to the internet, and a media server on a home network often shares that network with a corporate laptop, which makes Plex2Shell a remote-work exposure as much as a consumer one. The gap between the public write-up and live exploitation was one day.

What it is: CVE-2026-106931 is an OS command injection (CWE-78) in EG Secure Solutions SiteGuard Server Edition, a host-based web application firewall, that lets a local user with low privileges execute arbitrary OS commands with root or SYSTEM privileges when the statistics feature is enabled.

Affected products and versions: SiteGuard Server Edition for Apache httpd, Nginx and IIS from Ver2.20 to before Ver8.00 Update 5, and SiteGuard Server Edition on FreeBSD from Ver2.20 to before Ver7.00 Update 6, when the statistics feature is enabled, which is the default.

Severity: CVSS 8.5 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, assigned by JPCERT/CC); CVSS 3.0 score 7.8. EPSS 0.00662.

Exploitation status: Confirmed in the wild. JVN, published 14 October 2026, states the vulnerability has been confirmed to be exploited, and both the vendor and JPCERT/CC flagged it. No details of the exploitation activity have been published. Added to CISA KEV on 20 October 2026. Federal remediation due date 23 October 2026.

Patch status: Fixed in Ver8.00 Update 5 for Apache httpd, Nginx and IIS, and Ver7.00 Update 6 for FreeBSD. For end-of-life versions, the developer offers a patch that replaces the files used in statistical processing.

What to do: Upgrade to Ver8.00 Update 5 or Ver7.00 Update 6, or apply the developer’s file-replacement patch. If you cannot patch immediately, disable the statistics feature. Review web servers running SiteGuard for unexpected processes and accounts created since early October 2026, and treat any such host as a candidate for full rebuild given the root-level outcome.

Why it matters: CVE-2026-106931 needs local access, so attackers use it after landing on a web server through another flaw, and it hands them root or SYSTEM on arrival. A WAF that becomes a privilege escalation path inverts its purpose: the control meant to protect the web tier hands the attacker the host.

1Attackers bought Google Search ads for terms such as “google cloud” and “gcp” that led through a redirect to an adversary-in-the-middle login page, which captured the password and MFA code and used them immediately.

2In existing low-usage projects, the attacker enabled the Gemini API and created service accounts with Gemini API keys.

3The attacker deleted the iam.allowedPolicyMemberDomains organisation policy and added external accounts to the billing account as billing administrators.

4The attacker linked its own Google Cloud projects to the victim’s billing account, so the usage was billed to the victim while the workloads ran in tenants the victim could not see.

5The attacker demoted the legitimate billing admins to viewers and operated from IP addresses in the victim’s home country. Victims saw Gemini API charges of tens to hundreds of thousands of dollars within 24 to 48 hours.

Why it matters: The technique turns a cloud billing account into the asset under attack, and the victim’s own audit logs cannot show what the stolen compute was used for. It is not isolated: Wiz’s analysis of this week’s LiteLLM supply chain compromise found the stolen credentials being checked with sts:GetCallerIdentity, then bedrock:ListFoundationModels, then ListModels, which Wiz describes as consistent with LLMjacking. Model access is becoming a thing worth stealing in its own right, and the cost and the content of an attacker’s usage can both sit outside your visibility while your organisation pays for it.

CVE	Product	CVSS	Date added to KEV	Federal due date
CVE-2026-96652	Plex Media Server (SSRF)	5.3, CVSS 4.0 (CISA)	20 Oct 2026	3 Nov 2026
CVE-2026-96654	Plex Media Server (encoded URI injection)	6.9, CVSS 4.0 (CISA)	20 Oct 2026	23 Oct 2026
CVE-2026-96655	Plex Media Server (SSRF)	5.3, CVSS 4.0 (CISA)	20 Oct 2026	3 Nov 2026
CVE-2026-96656	Plex Media Server (file path control)	8.6, CVSS 4.0 (CISA)	20 Oct 2026	23 Oct 2026
CVE-2026-106931	EG Secure Solutions SiteGuard Server Edition	8.5, CVSS 4.0 (JPCERT/CC)	20 Oct 2026	23 Oct 2026
CVE-2026-110936	Siemens Software Center (DLL search path)	8.4, CVSS 4.0 (Siemens)	20 Oct 2026	3 Nov 2026
CVE-2026-110447	Collabora Online built-in CODE server	9.2, CVSS 4.0	23 Oct 2026	26 Oct 2026
CVE-2026-114625	Arista VeloCloud Orchestrator	9.9 (Arista)	23 Oct 2026	26 Oct 2026