SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefSaturday, October 24, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Active Edge Zero-Day Exploitation and Perimeter Compromises | CRITICAL |
|
5 C2 IPs | 67 OTX IOCs | 33 ARTICLES |
|
■ ANALYST TLDR Threat actors are actively targeting perimeter infrastructure, exploiting zero-day vulnerabilities in Arista VeloCloud Orchestrator alongside compromising credentials across Fortinet FortiGate and Palo Alto Networks GlobalProtect devices. High-impact software supply chain and dependency vulnerabilities have surfaced in Python Pillow (CVE-2026-112900), LiteLLM, Ruby, and PHP (CVE-2026-115560). Meanwhile, nation-state groups including Sandworm, China-linked APTs, and APT28 are leveraging novel UEFI bootkits, mesh backdoors, and AI-powered penetration testing tools in ongoing operations. |
|
■ CRITICAL STORIES Attackers Exploit Third Arista VCO Zero-Day in Four Months A critical unpatched SQL injection zero-day in Arista VeloCloud Orchestrator is being actively exploited in the wild to grant unauthorized access to internal functionality and operator privileges. |
Hackers Breach Enterprise Firewalls and VPNs Exposing 70,000 Credentials Threat actors breached Palo Alto Networks GlobalProtect and Fortinet FortiGate edge devices, compromising more than 70,000 user credentials for downstream network intrusions. |
Supply Chain Compromise Hits LiteLLM via Python Startup Hooks Attackers leveraged compromised GitHub CLI OAuth tokens to publish malicious PyPI packages for LiteLLM 1.107.0, relying on Python startup hooks for credential theft and remote code execution. |
Critical Flaw in Python Pillow Library (CVE-2026-112900) Enables Code Execution A command execution vulnerability in Python's widely used Pillow image library allows arbitrary OS commands to be executed when processing specially crafted EPS images. |
|
■ CVEs IDENTIFIED CVE-2026-112900 Python Pillow Library — Remote Code Execution via crafted EPS image files |
CVE-2026-115560 PHP Group PHP — Remote Code Execution in non-default web server configurations |
[CVE-TBD] Arista Networks VeloCloud Orchestrator — Zero-day SQL injection leading to elevated operator privileges |
[CVE-TBD] HPE ArubaOS — Remote Code Execution and Authentication Bypass across 8 max-severity flaws |
|
■ THREAT ACTORS Sandworm | Nation-State (Russia) |
Deployed a new mesh network backdoor in destructive wiping attack against Ukrainian logistics firm |
UAC-0099 (Earth Sirrush) | Cyberespionage |
Partnered with Sandworm in destructive cyber operations against Ukrainian logistics targets |
APT28 | Nation-State (Russia) |
Targeted NATO defense sector organizations |
|
|
|
■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | Active exploitation of Fortinet, Palo Alto Networks, Arista VCO, and ConnectWise edge infrastructure |
| T1195.002 | | Supply Chain Compromise: Compromise Software Dependencies | Compromised GitHub CLI OAuth tokens used to push malicious LiteLLM PyPI packages |
| T1542.001 | | Pre-OS Execution: System Firmware / Bootkit | BlackX UEFI Bootkit used against diplomatic entities in Central Asia |
| T1553.006 | | Subvert Trust Controls: Code Signing / Revocation Bypass | BlackX bootkit bypassed Secure Boot on systems missing DBX revocations |
| T1546 | | Event Triggered Execution | Python startup hooks used to steal credentials in LiteLLM supply chain attack |
| T1552 | | Unsecured Credentials | Over 70,000 credentials stolen from edge VPNs; OAuth tokens stolen in supply chain attack |
|
■ PATCH PRIORITY Python Pillow — CVE-2026-112900 allows remote OS command execution via EPS image handling — [THN] |
PHP — CVE-2026-115560 unpatched RCE vulnerability in non-default web configurations — [THN] |
HPE ArubaOS — 8 maximum-severity RCE and authentication bypass vulnerabilities — [BC] |
Arista Networks VeloCloud Orchestrator — Active zero-day SQL injection exploitation — [SW] |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Apply security updates or vendor-recommended mitigations for PHP (CVE-2026-115560) and audit non-default web configurations. |
| 2 | [P1] Update Python Pillow library immediately to resolve CVE-2026-112900 and stop OS command execution via crafted EPS images. |
| 3 | [P1] Update HPE ArubaOS installations to address the 8 critical remote code execution and authentication bypass vulnerabilities. |
| 4 | [P2] Audit and reset credentials associated with Fortinet FortiGate and Palo Alto Networks GlobalProtect edge devices, enforcing MFA across all accounts. |
| 5 | [P2] Update Ruby runtimes to versions 4.0.9, 3.4.12, or 3.3.13 to patch Onigmo regex engine flaws affecting GitLab environments. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |