October 25, 2026
- CISA added Arista VeloCloud Orchestrator CVE-2026-114625 (CVSS 9.9) and Collabora Online CVE-2026-110447 (CVSS 9.2) to KEV, with an October 26 federal deadline. The VeloCloud SQL injection needs only an authenticated session at Enterprise Read Only level to reach privileged internal functionality; Arista named two Japan-geolocated IPs but no actor. It is the third weaponised VCO flaw since July 2026, after CVE-2026-16812 and CVE-2026-93952. The Collabora command injection is being used to drop web shells on Nextcloud servers and hunt for credential stores, password-manager artifacts and crypto wallets. (The Hacker News)
· Vulnerabilities & Exploits
in When the Red Team Is the Model: OpenAI's Agents Escaped Their Own Sandbox
October 17, 2026
- Nextcloud's built-in Collabora CODE server flaw (CVE-2026-110447) also has a public reproduction out (Doonsec). Worth noting from BleepingComputer's reporting: Second Security measured a median 39-day gap between a public fix and CVE publication for open-source flaws in August, up from 5.1 days in January, with exploit code sometimes appearing within hours of the fix (BleepingComputer) (earlier coverage).
· Active Exploitation
in Thirty-Seven Years of a Signed Short, and a Root Shell on OpenBSD
October 15, 2026
- Administrators are reporting backdoored Nextcloud servers running Collabora’s Built-in CODE Server. The reports tie compromise to the
richdocumentscode app and a critical flaw in the bundled Collabora Online CODE component, making exposed hosts an incident-response case rather than patch-only work. GitHub issue, The Hacker News (discussion)
· Active Exploitation
in A Crafted Attachment Can Root Cisco’s Secure Email Gateway
July 21, 2026
in Microsoft Graph Becomes a Spy's Dead Drop as WordPress "wp2shell" Exploitation Goes Live
June 24, 2026
- PixelSmash, a critical RCE in FFmpeg's MagicYUV decoder, lets a crafted media file execute code in any app using libavcodec — RCE on Jellyfin under certain conditions, and DoS in Kodi, Emby, Nextcloud, PhotoPrism, and OBS. Now patched. JFrog, BleepingComputer.
· Vulnerabilities & Exploits
in Two Netlogon Flaws Hit Domain Controllers as FortiBleed Lands in Finland