Cyber Security News

Hacking Editorial Brief — October 24, 2026

Mirai Operators Deploy Botnet Variant in PHP2Shell Campaign as ASLR Bypass Exploits Surface

Threat actors have pivoted PHP2Shell exploitation toward botnet deployment, with Sophos researchers observing attempts to install Potassium—believed to be a Mirai variant—through the CVE-2026-109618 and CVE-2026-109619 vulnerabilities. The development marks an evolution from initial reconnaissance activity to active payload deployment in the days following disclosure. Separately, researchers have developed proof-of-concept exploits that bypass Address Space Layout Randomization (ASLR) protections, potentially increasing the reliability of exploitation against vulnerable PHP installations. The operational impact of these campaigns has not been independently verified, though the exploit attempts continue at scale. Organizations in Japan and Finland took websites offline as a precautionary measure, with Dutch cybersecurity authorities warning the situation could deteriorate further.

Arista Patches Third VeloCloud Orchestrator Zero-Day in Four Months

Arista Networks disclosed CVE-2026-114625, a critical SQL injection vulnerability in VeloCloud Orchestrator that allows authenticated users to escalate privileges and access internal functionality. The flaw represents the third actively exploited zero-day in the VeloCloud platform within four months, indicating sustained targeting of the SD-WAN infrastructure. Arista confirmed active exploitation but has not disclosed victim counts or campaign scope. In law enforcement developments, the FBI arrested Edward Dubrovsky, a Toronto-area cybersecurity executive, on charges of colluding with cybercriminals in an extortion scheme, according to court documents. The UK's National Cyber Security Centre is investigating a Beijing-backed intrusion campaign amid concerns over potential compromise of sensitive information, though specific victims and operational details have not been disclosed.

Sources: The Hacker News · SecurityWeek · DutchNews · SecurityWeek · CBC · The Telegraph