Today's cybersecurity round-up highlights several critical vulnerabilities and active exploitation, alongside a significant data breach affecting sensitive information. We also see new developments in threat actor tactics and evolving privacy policies from major tech companies.
Critical Flaws in Collabora Online and Arista VeloCloud Actively ExploitedVulnerability
CISA has issued a warning about two critical vulnerabilities, CVE-2026-110447 and an unnamed flaw in Arista VeloCloud Orchestrator, which are currently being actively exploited. These issues affect the Collabora Online Built-in CODE Server and Arista's network orchestration platform respectively. Organizations using these systems are urged to take immediate action.
Why it matters: Actively exploited vulnerabilities can lead to immediate system compromise; small businesses using these services should apply patches without delay to prevent attackers from gaining unauthorized access.
Read more at The Hacker News ↗
Widespread Brotli Decoder Flaw Poses RCE Risk Across Multiple PlatformsVulnerability
A memory corruption vulnerability, CVE-2026-111497, has been identified in Google's Brotli decoder. This flaw impacts a wide array of software that processes Brotli-compressed data, including Node.js, Bun, Python packages, and Envoy proxies. Exploitation could lead to remote code execution by allowing specially crafted compressed data to corrupt memory.
Why it matters: Given the widespread use of Brotli compression, businesses using affected software should monitor for updates and apply patches to prevent potential system compromise through malicious data.
Read more at The Hacker News ↗
LiteLLM Master Key Leak Leads to Supply Chain AttackBreach
A master key for LiteLLM's Agent Platform was inadvertently exposed in a public GitHub repository in May 2026. This security lapse enabled threat actors to hijack the release pipeline and push a malicious version of the popular Python package. The incident underscores the risks associated with managing sensitive credentials.
Why it matters: Supply chain attacks are a significant risk; businesses should regularly audit their software dependencies and ensure that all development and deployment credentials are kept strictly private and secure.
Read more at The Hacker News ↗
BlackX UEFI Bootkit Evades Secure Boot Using Baton Drop FlawThreat
A new UEFI bootkit named BlackX was deployed in an espionage campaign earlier this year, exploiting the previously known Baton Drop vulnerability. This tactic allowed the bootkit to bypass Secure Boot, enabling the loading of a malicious driver designed to interfere with various security solutions, including those from Kaspersky and Avast.
Why it matters: Advanced threats like UEFI bootkits can bypass traditional security measures; small businesses should ensure firmware is updated and consider advanced endpoint protection that can detect such low-level compromises.
Read more at BleepingComputer ↗
8.3 Million Records Stolen from Crime Tip Platform Navigate360Breach
Navigate360, a platform used by schools and police nationwide for anonymous crime tips, suffered a data breach resulting in the theft of 8.3 million records. Nevada, which uses the SafeVoice tip line, confirmed its service was compromised. The incident highlights concerns about the delayed disclosure of the hack.
Why it matters: Data breaches affecting third-party services can expose sensitive customer or employee information; businesses should vet their vendors' security practices and have clear agreements on breach notification timelines.
Google Updates Privacy Policy Regarding AI Search and Targeted AdsPolicy
Google has revised its privacy policy to clarify that users who opt into personalized AI features in Search or Gemini may have their data from other connected Google services used for targeted advertising. This update aims to explicitly communicate how user activity across various Google products could inform ad delivery when AI features are utilized.
Why it matters: Businesses should be aware of evolving privacy policies from major tech platforms, especially concerning data usage for advertising, as this can impact how they communicate data practices to their own customers.
Read more at The Hacker News ↗
Researchers Disable Millions of Potentially Malicious Popcorn Time UpdatersOther
Security researchers at Eye Security pushed over 2 million updates to remotely disable a background updater belonging to the abandoned Popcorn Time streaming application. This action was taken to neutralize a potential botnet threat, as the updater could have been exploited by malicious actors to take control of affected machines.
Why it matters: Outdated or abandoned software can become a significant security liability; small businesses should regularly audit and remove unneeded or unsupported applications from their systems to close potential attack vectors.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.