{"id":96,"date":"2026-10-25T07:41:29","date_gmt":"2026-10-25T06:41:29","guid":{"rendered":"https:\/\/mspbusiness.com\/en\/it-news\/patchwork-sunday-25-october\/"},"modified":"2026-10-25T11:29:19","modified_gmt":"2026-10-25T10:29:19","slug":"patchwork-sunday-25-october","status":"publish","type":"post","link":"https:\/\/mspbusiness.com\/en\/security\/patchwork-sunday-25-october\/","title":{"rendered":"Patchwork &#8211; Sunday 25 October"},"content":{"rendered":"<p id=\"top\"><strong>This edition focuses on critical vulnerabilities that are already being exploited. Attackers are using an SQL injection in Arista VeloCloud Orchestrator, installing webshells via Collabora Online on Nextcloud servers and breaking into FortiGate and GlobalProtect firewalls. In addition, PHP is warning of a new RCE risk with no emergency patch.<\/strong><\/p>\n<ul>\n<li><a href=\"#velocloud\">Arista VeloCloud Orchestrator: SQL injection gives attackers admin rights, third exploited flaw since July<\/a><\/li>\n<li><a href=\"#collabora\">Collabora Online in Nextcloud: critical flaw exploited to plant webshells<\/a><\/li>\n<li><a href=\"#php\">PHP: new RCE risk with no emergency patch, two days after the PHP2Shell updates<\/a><\/li>\n<li><a href=\"#k0t\">Attacker k0t breaches FortiGate and GlobalProtect firewalls: more than 70,000 credentials exposed<\/a><\/li>\n<\/ul>\n<h4 id=\"velocloud\">Arista VeloCloud Orchestrator: SQL injection gives attackers admin rights, third exploited flaw since July<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">SQL injection in on-premise Arista VeloCloud Orchestrator (VCO). An attacker with a valid session, holding at least the Enterprise Read Only role, gains access to privileged internal functions<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-114625<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">9.9<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, Arista confirms the flaw is being exploited in the wild; CISA added it to the KEV catalogue on 23 October 2026<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, released in October 2026: versions 5.2.3.18, 6.1.3.10 and 6.4.2.12<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has it been exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/thehackernews.com\/2026\/10\/cisa-flags-two-actively-exploited.html\" target=\"_blank\" rel=\"noopener\">The Hacker News<\/a>, Arista has confirmed that attackers are already using the flaw. The attacker needs network access to the VCO&#8217;s web interface, plus a valid session. Arista has not attributed the activity to any group and has given no technical details of what attackers do after escalating their privileges. It did, however, share two IP addresses geolocated to Japan: 74.82.197[.]86 and 38.54.50[.]151.<\/p>\n<p><strong>What could the impact be?<\/strong><\/p>\n<p>The VCO manages an organisation&#8217;s SD-WAN environment, so anyone with admin rights on it can change the configuration of every connected site. This is already the third VCO flaw to be exploited since July 2026, following two earlier vulnerabilities with the maximum score of 10.0. For MSPs managing SD-WAN for customers, that is a pattern to take seriously.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Update on-premise VCOs to 5.2.3.18, 6.1.3.10 or 6.4.2.12. Restrict network access to the web interface, review accounts with the Enterprise Read Only role and search the logs for traffic from the two IP addresses mentioned. The report cites a deadline of 26 October 2026 for US government agencies; that timeframe is a good guideline for you too.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"collabora\">Collabora Online in Nextcloud: critical flaw exploited to plant webshells<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">OS command injection in Collabora Online Built-in CODE Server (richdocumentscode) when used with Nextcloud, via proxy.php when the local CODE document server is not running<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-110447<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">9.2<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, attackers are planting webshells on Nextcloud servers; CISA added the flaw to the KEV catalogue on 23 October 2026<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, since September 2026 in version 26.4.303<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has it been exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/thehackernews.com\/2026\/10\/cisa-flags-two-actively-exploited.html\" target=\"_blank\" rel=\"noopener\">The Hacker News<\/a>, attackers execute commands on the server via proxy.php and use this to install a webshell. They then perform reconnaissance on the system and search for credential stores, password manager files and crypto wallets.<\/p>\n<p><strong>What could the impact be?<\/strong><\/p>\n<p>A compromised Nextcloud server provides access to business documents and often to keys and passwords stored on the same machine. For MSPs hosting Nextcloud for SMEs, a single vulnerable instance can quickly put a customer&#8217;s data at risk.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Check whether the Collabora Online Built-in CODE Server is running and update to 26.4.303 or later. On servers that have not been updated for some time, look for unknown files and calls to proxy.php, and replace any credentials that were stored on the server if you cannot rule out a compromise.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"php\">PHP: new RCE risk with no emergency patch, two days after the PHP2Shell updates<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Possible remote code execution in PHP under a specific configuration: session.serialize_handler is set to php_binary or php_serialize, is changed to php at runtime using ini_set() before session_start(), and session upload progress is enabled. PHP itself describes it as &#8216;an unlikely risk&#8217;. Affected versions have not been disclosed<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-115560<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, no exploitation reported (as of 23 October 2026). The attacks since 21 October target the earlier PHP2Shell flaws<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, the fix will follow in the next regular bugfix release. Mitigation: set session.upload_progress.enabled=0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has it been exploited?<\/strong><\/p>\n<p>No exploitation of this flaw has been reported yet. According to <a href=\"https:\/\/thehackernews.com\/2026\/10\/urgent-php-warns-of-another-unpatched.html\" target=\"_blank\" rel=\"noopener\">The Hacker News<\/a>, this is a separate vulnerability from PHP2Shell (CVE-2026-109618 and CVE-2026-109619), for which PHP released emergency updates on 21 October in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Millions of attack attempts against those flaws have since been observed, including attempts to install a Mirai variant. So far, those attempts appear to have been unsuccessful.<\/p>\n<p><strong>What could the impact be?<\/strong><\/p>\n<p>A successful attack would allow an attacker to execute code on the web server. Because session upload progress is enabled by default, the risk depends mainly on whether an application switches the session handler at runtime. That is quite possible with custom code and older CMS plugins.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>First install the PHP2Shell updates if you have not already done so. In addition, set session.upload_progress.enabled=0 on hosting platforms and customer servers until the fix is released. If you have already changed that setting for CVE-2026-109619, no further action is needed.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"k0t\">Attacker k0t breaches FortiGate and GlobalProtect firewalls: more than 70,000 credentials exposed<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Campaign against internet-facing edge devices, chiefly Fortinet FortiGate and Palo Alto Networks GlobalProtect, using known vulnerabilities and brute force against commonly used credentials. The report does not mention version numbers<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2025-64446 (path traversal in FortiWeb) and CVE-2026-0257 (authentication bypass in PAN-OS and Prisma Access)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, according to Group-IB and NyxLab, reported on 23 October 2026; many of the intrusions took place between February and June 2026<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">The report does not mention versions. Install the available fixes from Fortinet and Palo Alto Networks and use strong, unique credentials<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has it been exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/thehackernews.com\/2026\/10\/hackers-breach-enterprise-firewalls-and.html\" target=\"_blank\" rel=\"noopener\">The Hacker News<\/a>, the actor k0t uses FOFA and ZoomEye to search for exposed VPN and firewall devices, breaks in via the flaws mentioned or by guessing passwords, and sets up a VPN connection with OpenConnect. This is followed by Active Directory reconnaissance, persistence using MeshCentral, Atera, Teramind and AnyDesk plus the AdaptixC2 framework, and data exfiltration with Rclone to Wasabi and MEGA. Group-IB and NyxLab link k0t to the ransomware groups Qilin and The Gentlemen.<\/p>\n<p><strong>What could the impact be?<\/strong><\/p>\n<p>The use of legitimate management tools such as Atera and AnyDesk makes the attacker&#8217;s presence hard to distinguish from normal MSP management activity. Around 15.8 per cent of victims are in Europe, and many victims later appeared on ransomware groups&#8217; leak sites.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Patch FortiGate, FortiWeb and PAN-OS systems, remove management interfaces from the internet and enable multi-factor authentication on VPN accounts. Search your environment for RMM tools you did not install yourself, for outbound traffic to Wasabi and MEGA, and for unexpected OpenConnect connections.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Attackers exploit critical flaws in Arista VeloCloud Orchestrator and Collabora Online for Nextcloud, breach Fortinet and Palo Alto Networks firewalls, while PHP warns of a new RCE risk.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"mspb_bron_id":1169402,"mspb_url_nl":"https:\/\/mspbusiness.com\/security-en-privacy\/patchwork-zondag-25-oktober\/","mspb_url_de":"https:\/\/mspbusiness.com\/de\/security\/patchwork-sonntag-25-oktober\/","mspb_url_en":"","mspb_beeld_url":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-G.png","mspb_beeld_klein":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-G-400x225.png","mspb_auteur":"Redactie","mspb_beeld_alt":"","mspb_video":"","_yoast_wpseo_metadesc":"Arista VeloCloud Orchestrator is being exploited, as is Collabora Online in Nextcloud. PHP and k0t attacks on firewalls also demand action.","footnotes":""},"categories":[3],"tags":[],"layout":[6],"class_list":["post-96","post","type-post","status-publish","format-standard","hentry","category-security","layout-news"],"_links":{"self":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/96","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/comments?post=96"}],"version-history":[{"count":1,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/96\/revisions"}],"predecessor-version":[{"id":97,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/96\/revisions\/97"}],"wp:attachment":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/media?parent=96"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/categories?post=96"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/tags?post=96"},{"taxonomy":"layout","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/layout?post=96"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}