SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefFriday, October 23, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Arista VeloCloud Zero-Day SQLi Actively Exploited | CRITICAL |
|
5 C2 IPs | 53 OTX IOCs | 35 ARTICLES |
|
■ ANALYST TLDR Today's intelligence highlights active zero-day exploitation of Arista VeloCloud Orchestrator via SQL injection alongside pre-patch wild exploitation of PHP2Shell vulnerabilities. Critical software supply chain risks emerged as the LiteLLM PyPI pipeline was backdoored with secret-stealing malware, while eMudhra withdrew from the global SSL/TLS business following the compromise of eight weakly generated intermediate CA keys. Additionally, Chinese nation-state actors are using automated AI agents to target ConnectWise software and IT infrastructure worldwide. |
|
■ CRITICAL STORIES Arista Patches Actively Exploited VeloCloud Orchestrator Zero-Day Attackers are actively exploiting an unauthenticated zero-day SQL injection flaw in Arista VeloCloud Orchestrator (VCO) On-Prem deployments to access central SD-WAN management systems. |
LiteLLM Release Pipeline Compromised to Distribute Info-Stealer Malware Threat actors hijacked the LiteLLM project's PyPI package and Docker build pipeline, deploying malicious images containing payloads that harvest API keys, secrets, and environment variables. |
Amazon Confirms PHP2Shell Zero-Day Exploitation Began 4 Days Before Patch Availability Security research confirms malicious targeting of PHP2Shell remote code execution flaws began on October 17, four days before vendors published security updates. |
Eight eMudhra Intermediate CA Private Keys Compromised Due to Weak Generation Public disclosure revealed eight eMudhra SSL/TLS intermediate CA private keys were generated with easily guessable numbers, exposing global traffic to unauthorized certificate signing and MitM interception. |
|
■ CVEs IDENTIFIED [CVE-TBD] Arista VeloCloud Orchestrator — SQL Injection flaw allowing unauthorized access to SD-WAN management |
[CVE-TBD] GitLab Community and Enterprise Editions — Regular Expression Compiler flaw causing arbitrary code execution |
ZDI-CAN-33774 Linux Kernel (KSMBD SMB Server) — Remote Code Execution vulnerability in kernel SMB module |
[CVE-TBD] PHP / PHP2Shell Vulnerable Frameworks — Remote Code Execution vulnerability exploited as zero-day |
|
■ THREAT ACTORS Chinese State-Sponsored Hackers | Nation-State / APT |
Utilizing automated ARTEX AI agents to execute supply chain attacks against ConnectWise and target global IT management infrastructure. |
Unidentified Exploitation Group | Cybercrime |
Actively exploiting Arista VeloCloud Orchestrator zero-day SQL injection flaws in wild environments. |
Unidentified Supply Chain Attacker | Cybercrime |
Compromised LiteLLM PyPI releases and Docker build pipelines to deploy credential-stealing malware. |
|
|
|
■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | Zero-day SQLi exploitation against Arista VeloCloud Orchestrator and pre-patch exploitation of PHP2Shell. |
| T1195.002 | | Supply Chain Compromise: Compromise Software Dependencies | Hijacking of LiteLLM PyPI package and Docker image build pipeline. |
| T1552.001 | | Unsecured Credentials: Credentials In Files | Info-stealer payloads targeting environment variables, database passwords, and API keys stored in developer environments. |
| T1573 | | Encrypted Channel | Man-in-the-Middle potential due to compromised eMudhra intermediate CA private signing keys. |
| T1059 | | Command and Scripting Interpreter | Command execution flaws patched across Cisco devices and unpatched Linux KSMBD SMB server vulnerabilities. |
| T1078 | | Valid Accounts | Abuse of stolen GitHub access tokens and OAuth credentials in rapid, machine-speed automated attacks. |
|
■ PATCH PRIORITY Arista VeloCloud Orchestrator — Actively exploited zero-day SQL injection vulnerability — [BC] |
GitLab — Max severity (10.0) Regular Expression Compiler flaw leading to arbitrary code execution — [BC] |
PHP Stack / Affected Products — Pre-patch zero-day exploitation of PHP2Shell vulnerabilities observed — [BC] |
Linux Kernel (KSMBD) — CVSS 9.0 unpatched remote code execution flaws publicly disclosed — [THN] |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Immediately apply security patches to Arista VeloCloud Orchestrator (VCO) On-Prem deployments to mitigate active zero-day SQL injection exploitation [CVE-TBD]. |
| 2 | [P1] Revoke and rotate all API keys, database credentials, and secrets hosted on Railway PaaS or used within Python environments leveraging LiteLLM packages. |
| 3 | [P1] Apply urgent security updates to GitLab installations to eliminate the maximum severity Regular Expression Compiler code execution vulnerability [CVE-TBD]. |
| 4 | [P2] Block and untrust all eight compromised eMudhra intermediate CA certificates across enterprise PKI trust stores, firewalls, and endpoint browsers. |
| 5 | [P2] Identify and patch all instances of PHP running applications susceptible to PHP2Shell [CVE-TBD], reviewing web server logs from October 17 onwards for signs of compromise. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |