TL;DR
Arista VeloCloud Orchestrator zero-day SQL injection is actively exploited; Railway platform users must rotate secrets immediately; Capcom confirms numerous account breach; LiteLLM supply chain compromised with credential-stealing malware. Patch and rotate credentials across all affected systems today.
Executive Summary
- Arista Networks patched an actively exploited SQL injection zero-day in VeloCloud Orchestrator (VCO) central management systems used for SD-WAN networks.
- Railway, a cloud platform for hosting application environment variables, detected suspicious activity and warns users to rotate secrets immediately.
- Capcom confirmed hackers breached its CAPCOM ID membership service, exposing 11.7 million customer email addresses and associated information.
- LiteLLM's release pipeline was compromised; attackers published malicious PyPI packages and Docker images containing credential and secrets-stealing malware.
- Microsoft issued patches for more than 1,400 security vulnerabilities across Windows and enterprise software.
Top Threats Today
1. Arista VeloCloud Orchestrator SQL Injection Zero-Day Under Active Exploitation
Severity: CRITICAL Affected: Technology
Arista Networks released security updates to patch a SQL injection zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments that is being actively exploited in attacks [1][2]. The flaw allows an attacker who can log in to the orchestrator—even with read-only credentials—to execute arbitrary SQL commands [1]. VeloCloud is the central management system for VeloCloud SD-WAN networks, which are widely deployed in enterprise environments [1]. Arista assigned four CVE identifiers to related vulnerabilities: CVE-2026-114625, CVE-2026-7473, CVE-2026-16812, and CVE-2026-93952 [2].
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Immediately apply Arista's published security updates to all VeloCloud Orchestrator On-Prem instances.
- Review access logs for suspicious SQL queries or unauthorized authentication attempts.
- Audit and restrict VCO access to only users requiring management privileges; revoke read-only accounts if not actively in use.
- Monitor for unusual outbound traffic or data exfiltration from VCO systems.
2. Railway Cloud Platform Warns of Potential Breach; Developer Secrets Exposed
Severity: HIGH Affected: Technology
Railway, a cloud platform that stores customer environment variables and secrets, detected suspicious activity on its systems earlier this week and published an urgent warning to users [1]. Environment variables typically contain API keys, database passwords, and other credentials used to access internal systems ⚠[1].
Sources:[1] BleepingComputer
Recommended Action
- Log into Railway immediately and rotate all stored secrets, API keys, and database credentials.
- Audit logs to determine which secrets may have been exposed and what systems they control.
- Review and revoke any credentials that accessed sensitive internal systems during the suspicious activity period.
- Enable multi-factor authentication and IP whitelisting on Railway accounts if available.
3. Capcom CAPCOM ID Membership Service Breached; 11.7 Million Accounts Exposed
Severity: HIGH Affected: Retail
Japanese gaming giant Capcom confirmed that hackers breached its CAPCOM ID membership service, exposing more than 11.7 million customer email addresses and associated information [1]. The breach affects the centralized account system used by Capcom players worldwide.
Sources:[1] BleepingComputer
Recommended Action
- If you have a CAPCOM ID account, change your password immediately and enable multi-factor authentication.
- Monitor for phishing emails claiming to be from Capcom or using exposed email addresses.
- If your email was exposed, watch for credential stuffing attempts on other services; consider a credit freeze if financial data was accessible.
- Organizations: block known Capcom phishing indicators and educate employees about the breach.
4. LiteLLM Supply Chain Compromise: Malicious PyPI and Docker Packages Distribute Info-Stealer
Severity: CRITICAL Affected: Technology
Hackers compromised the LiteLLM project's release pipeline and published malicious versions on PyPI (Python Package Index) and Docker Hub with payloads designed to steal credentials, secrets, and environment variables [1]. LiteLLM is a Python library used by developers to integrate large language models into applications; any organization or developer using a compromised version would ⚠ have secrets exfiltrated to attacker-controlled systems [1].
Sources:[1] BleepingComputer
Recommended Action
- Immediately audit all Python environments and container deployments for LiteLLM versions installed between the compromise window and patch release.
- Rotate all API keys, database passwords, and secrets that may have been stored in environment variables on affected systems.
- Review network logs for data exfiltration to unknown external IPs during the compromise period.
- Update to the latest verified LiteLLM release from an official source and verify package integrity.
- Implement package verification and signed dependency checks in your CI/CD pipeline to detect future compromises.
5. Microsoft Patches 1,400+ Vulnerabilities in Windows and Enterprise Software
Severity: HIGH Affected: Technology
Microsoft issued updates to fix more than 1,400 security vulnerabilities in Windows operating systems and other software [1]. This patch batch significantly exceeds the September record of nearly 1,000 fixes, indicating a substantial vulnerability backlog [1]. CVE-2026-108398 and CVE-2026-96951 are among the vulnerabilities patched [1].
Sources:[1] Krebs on Security
Recommended Action
- Prioritize patching Windows systems and Microsoft enterprise products (Exchange, Office, Azure services) in your environment.
- Test critical patches in a staging environment before broad deployment to avoid service disruption.
- Deploy patches in waves to high-risk systems (internet-facing servers, domain controllers, email systems) first.
- Monitor for exploitation attempts targeting CVE-2026-108398 and CVE-2026-96951 in particular.
Today’s Action Checklist
- ☐ URGENT: Apply Arista VeloCloud Orchestrator security patches to all On-Prem instances; review access logs for signs of exploitation.
- ☐ URGENT: If using Railway platform, rotate all stored secrets and API keys immediately.
- ☐ URGENT: Audit Python and container environments for compromised LiteLLM versions; rotate all exposed credentials.
- ☐ PRIORITY: Test and deploy Microsoft security updates to Windows and enterprise software in your estate.
- ☐ PRIORITY: If you have a CAPCOM ID account or operate Capcom services, reset passwords and enable MFA; watch for phishing.