CYBER THREATCAST

Patch PHP 5.4 through 8.5 immediately, prioritizing Apache mod_php deployments and PHP components used by Apex One and Apex Central. Exploitation attempts preceded the emergency fixes, a European government entity was compromised, and AI-generated exploit code spread rapidly. Where patching cannot proceed immediately, apply the documented temporary service-stopping and PHP-directory-renaming mitigations; upgrade Apex One servers to build 18012 or later before following its documented procedure.

Install Arista’s fixed builds for on-premises VeloCloud Orchestrator and review basic authenticated accounts for unexpected operator-level access. CVE-2026-114625 is an actively exploited, CVSS 9.9 authenticated SQL injection flaw that can elevate a basic user to operator privileges; CISA has added it to the Known Exploited Vulnerabilities catalog.

Upgrade every Electrum Bitcoin wallet to version 4.8.3 before making further payments. Malicious Electrum servers have exploited the transaction-verification flaw in earlier versions to redirect Bitcoin transactions and steal funds, making continued use of versions before 4.8.3 an immediate financial risk.

Remove LiteLLM 1.107.0 PyPI wheels and affected container images, purge cached artifacts, rotate credentials exposed on systems that installed or pulled them, and investigate those systems for compromise. All seven 1.107.0 wheels reportedly carried a credential stealer and remote-code loader, several official container tags were affected, and startup hooks could execute the malicious packages without an application importing LiteLLM. Do not rely on the clean GitHub v1.107.0 source tag to validate distributed artifacts.

Disable Tailscale SSH port forwarding where it is not essential, restrict authorized-device access to reachable servers, and enable Tailnet Lock while awaiting a fix. Researchers demonstrated that an attacker controlling an authorized device could abuse forwarding, privileged sockets, and a time-of-check/time-of-use race to gain root access; one chain also captured an enrollment key and joined an attacker-controlled machine as a trusted server when Tailnet Lock was disabled. No CVE or fixed version was available.