CYBER THREATCAST

Patch Collabora Online CVE-2026-110447 and Arista VeloCloud Orchestrator CVE-2026-114625 immediately, prioritizing internet-facing deployments. CISA lists both flaws as actively exploited, and Arista reports that a low-privilege attacker can elevate to operator privileges and impersonate a local superuser. VeloCloud administrators should also investigate systems for exploitation associated with the reported attack infrastructure.

Deploy Microsoft’s patch for Windows Shell CVE-2026-96951 across affected endpoints without waiting for the next routine maintenance window. Attackers exploited the flaw as a zero-day to bypass Mark of the Web protections after users interacted with crafted files or malicious links, weakening safeguards provided by Microsoft SmartScreen and Office Protected View.

Remove Palo Alto Networks Expedition from unnecessary internet exposure and investigate administrator-password changes or reset attempts. FortiGuard observed about 18,000 attacks in 24 hours, including unauthenticated attempts to reset administrator passwords; technology, education, finance, government, and telecommunications organizations were among the leading targets.

Quarantine LiteLLM 1.107.0 PyPI packages and container images, identify every environment that installed or ran them, and investigate exposed credentials. Attackers published compromised artifacts through official distribution channels after entering LiteLLM’s GitHub organization, and malicious Python startup hooks could execute payloads even when LiteLLM was not imported. Rotate credentials where investigation indicates exposure.

Lock down exposed Fortinet FortiGate, FortiWeb, and Palo Alto Networks GlobalProtect systems, patch known path-traversal and authentication-bypass flaws, and investigate brute-force activity. The k0t actor targeted firewalls and VPNs, reportedly exposed more than 70,000 credentials, used legitimate remote-management tools for persistence, and exfiltrated data to Wasabi S3 and MEGA. Review affected accounts and reset credentials where compromise is suspected.