U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Collabora Collabora Online – Built-in CODE Server flaw, tracked as CVE-2026-110447 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog. Collabora Online – Built-in CODE Server is an app for Nextcloud that lets you open, edit and collaborate on documents, spreadsheets and presentations directly in your browser, without needing Microsoft Office installed on your computer. It is based on Collabora Online and LibreOffice technology. CVE-2026-110447 is a critical OS command injection flaw in Nextcloud’s proxy.php that affects Collabora Online Built-in CODE Server before 26.4.303. Unauthenticated attackers can execute commands when the built-in server is stopped. Standalone Collabora servers are not affected. Update immediately. In versions up to 26.4.302, proxy.php included request data in a Bash command without proper sanitization, allowing attackers to execute OS commands as the web server user. Exploitation is possible only when the local CODE server is stopped, such as during a restart, upgrade or crash. The script runs directly through the web server without loading Nextcloud’s code. Exploitation has been reported since September 2026, with attackers deploying PHP web shells and stealing configuration files containing credentials and application secrets. Three administrators reported the vulnerability on GitHub, while the first recorded attack dates back to September 10. The first attack was reported by a Nextcloud administrator whose servers had been compromised. Logs showed malicious requests on September 10 and 11, 2026, from the same IP, targeting proxy.php on version 26.4.302. The attackers deployed a PHP web shell and searched one server for credential stores and cryptocurrency wallets. Although reviewed logs showed no file exfiltration commands, data accessible to the web server account must be considered potentially exposed. Two other administrators reported similar incidents, but none found evidence of root access. After updating to 26.4.303, one administrator recorded another attempt on September 14, but no new shell appeared. Project maintainer mmeeks urged users to update and remove leftover shx*.php files. The CVE record confirms exploitation in September and October 2026, but the total number of compromised servers remains unknown. The flaw affects only the Development Edition’s Built-in CODE Server deployment. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by October 26, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. The operation has been attributed with medium confidence to APT41, a Chinese state-sponsored threat group also known as Brass Typhoon, Wicked Panda, and Barium. It was discovered in early 2026 and targeted diplomatic agencies in Central Asia, particularly in Tajikistan, Uzbekistan, and Turkmenistan. Kaspersky researchers analyzed the BlackX bootkit and found similarities with BlackLotus, which has been circulating on hacker forums since October 2022 and leveraged the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot protection. ESET confirmed in March 2023 that BlackLotus exploited Baton Drop, and at the time it could compromise even fully patched Windows 11 systems.
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services. "You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use,
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine. The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time, a free app that streamed pirated films and TV over BitTorrent. Popcorn Time was
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical Arista VeloCloud Orchestrator flaw, tracked as CVE-2026-114625 (CVSS score of 9.4), to its Known Exploited Vulnerabilities (KEV) catalog. VeloCloud Orchestrator (VCO) is the central management system for VMware SD-WAN, a technology that helps companies securely connect offices, data centers, cloud services, and remote sites over wide-area networks. It is now associated with Arista Networks, which acquired VMware’s SD-WAN business. The orchestrator gives network administrators a central place to configure, monitor, and manage the network. The flaw is a SQL Injection issue that affects on-premises VeloCloud Orchestrator (VCO). It allows an authenticated user to gain operator privileges and impersonate a local superuser operator account. This could give a remote attacker access to internal functions that should not be remotely available, potentially compromising the system and the data it manages. Hosted VCO versions, including Dedicated, were also affected but have already been patched. “VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.” reads the advisory. “On an affected system, any authenticated user can gain operator privileges and masquerade as a local “superuser operator” user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.” VeloCloud Orchestrator (VCO) is vulnerable by default. An attacker needs access to its web interface and a valid account. Even an account with the lowest permission level, Enterprise Read Only, is enough. No configuration change can prevent this exposure. Administrators should check web access logs for unusual requests, encoded text, attempts to access internal services, or an unusually high number of requests. They should also block these IP addresses linked to attacks: 74.82.197.86 38.54.50.151 If an attack is suspected, administrators should save web, application, system and database logs, along with relevant file timestamps, before starting recovery, if possible. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by October 26, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 (CVSS score: 9.2) - An operating
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers.
Microsoft says Teams will begin using AI-powered phishing detection in early November 2026 to detect malicious behavior in messages. The rollout is part of a targeted release phase expected to end by mid-November, with the new security feature likely reaching general availability worldwide between early and mid-December. Microsoft first revealed in a Microsoft 365 Roadmap entry last week that the AI-powered phishing detection will use conversation context (without retaining message content) to identify phishing and suspicious behavior in higher-risk messaging scenarios, such as external first-contact chats. "Microsoft Teams is introducing AI-powered, context-aware phishing detection to help identify phishing, social engineering, impersonation attempts, and deceptive intent," the company said in a Microsoft 365 Message Center update on Wednesday.
Confirm this action.
Leaving now will discard your changes.