Today's cybersecurity landscape highlights active exploitation of critical vulnerabilities and significant data breaches, alongside emerging threats from AI agents and evolving botnet tactics. Proactive patching and vigilance against sophisticated phishing campaigns remain crucial for all organizations.
Arista VeloCloud Orchestrator Zero-Day Under Active AttackVulnerability
A severe command injection flaw, CVE-2026-16812 (CVSS score 10.0), in on-premises versions of Arista VeloCloud Orchestrator (VCO) is being actively exploited. This vulnerability allows for arbitrary code execution, posing a critical risk to affected systems.
Why it matters: If you use Arista VeloCloud Orchestrator, immediately apply available patches to prevent attackers from gaining full control of your systems.
Read more at BleepingComputer ↗
FastJson RCE Zero-Day Exploited in Attacks on US FirmsVulnerability
Hackers are actively exploiting a zero-day remote code execution (RCE) vulnerability in the FastJson open-source Java library. This flaw allows attackers to execute code without user interaction or elevated privileges, targeting US firms.
Why it matters: Organizations using FastJson in their applications should be aware of this active threat and monitor for any security updates or mitigation strategies.
Read more at BleepingComputer ↗
Coca-Cola Confirms Data Theft After Fairlife Ransomware AttackRansomware
The Coca-Cola Company has confirmed a data breach affecting its dairy subsidiary, Fairlife, following a ransomware attack earlier this month. The Anubis cybercrime group has claimed responsibility and threatened to leak stolen data.
Why it matters: Even large corporations are susceptible to ransomware; regularly backing up your data and implementing strong cybersecurity measures are essential to protect your business from similar attacks.
Read more at BleepingComputer ↗
Ernst & Young Data Breach Claimed by ShinyHuntersBreach
The ShinyHunters extortion gang has claimed responsibility for a data breach at Ernst & Young (EY), asserting they obtained system credentials through a supply-chain attack. This incident highlights the growing risk of attacks on third-party vendors.
Why it matters: Supply chain attacks can impact your business through compromised partners; ensure your vendor contracts include strong security clauses and regularly assess your third-party risks.
Read more at BleepingComputer ↗
Origin Energy Data Breach Affects 900,000 AustraliansBreach
Australian energy provider Origin Energy has experienced a data breach, impacting approximately 900,000 customers. While initial claims suggested 2 million records were stolen, the confirmed number remains significant.
Why it matters: Data breaches can affect a large number of customers, leading to reputational damage and potential legal consequences. Prioritize data protection and incident response planning.
Dysphoria IoT Botnet Evolves with Blockchain C2Threat
The Dysphoria IoT botnet has evolved, adopting blockchain-based name services and using infected devices as relays. This sophisticated design makes the botnet significantly harder to disrupt, now compromising around 200,000 devices for DDoS and traffic relay operations.
Why it matters: Ensure all IoT devices connected to your network are regularly updated, use strong, unique passwords, and are segmented to limit potential damage from botnet infections.
Read more at BleepingComputer ↗
Autonomous AI Agent Used in Thai Ministry of Finance EspionageThreat
An autonomous open-source AI agent, Hermes, was reportedly used in 'YOLO mode' to conduct espionage against Thailand's Ministry of Finance. This incident highlights the emerging threat of AI-driven cyberattacks.
Why it matters: As AI agents become more prevalent, understanding their potential for misuse is critical. Implement strict access controls and continuous monitoring for suspicious automated activity within your systems.
Public Exploit Released for Patched vBulletin Pre-Auth Code Execution FlawVulnerability
Details for a public exploit have been released for a patched pre-authentication code execution vulnerability in vBulletin (CVE-2026-27577). The flaw allows unauthenticated attackers to execute code on unpatched forum servers without requiring an account or user interaction.
Why it matters: If you operate a vBulletin forum, verify that it is fully patched immediately to prevent unauthenticated remote code execution.
Read more at The Hacker News ↗
NVIDIA Leads Open Secure AI AllianceOther
NVIDIA, along with 36 other organizations including Microsoft, Cisco, and Cloudflare, has formed the Open Secure AI Alliance. The alliance aims to develop and share open technologies, techniques, and tools to secure software and artificial intelligence agents.
Why it matters: The security of AI is a growing concern; staying informed about initiatives like this alliance can help you understand future best practices for integrating and securing AI in your business operations.
Read more at The Hacker News ↗
GitHub Introduces Dependabot Cooldown for Supply Chain SecurityPolicy
GitHub has implemented a new three-day cooldown mechanism for Dependabot, delaying the opening of pull requests after a release is published. This measure aims to limit the adoption of potentially poisoned packages, enhancing supply chain security.
Why it matters: If your development workflow relies on Dependabot, be aware of this new cooldown period, which provides an extra layer of protection against malicious package introductions.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.