TL;DR
Dysphoria IoT botnet now controls ~200k devices and has adopted blockchain-based command infrastructure to resist takedown. n8n workflow platform patched a sandbox-escape RCE affecting authenticated users. Arista released patches for actively exploited VeloCloud Orchestrator zero-day.
Executive Summary
- Dysphoria botnet has grown to approximately 200,000 compromised devices globally and shifted to blockchain-based C2 infrastructure following law-enforcement disruption of JackSkid infrastructure.
- Arista has patched a maximum-severity command-injection vulnerability in VeloCloud Orchestrator that is being actively exploited in attacks; affected organizations should prioritize patching on-premises deployments.
- n8n workflow automation platform patched a high-severity sandbox-escape vulnerability allowing authenticated editors to execute OS commands; the flaw was discovered during review of an earlier CVE-2026-27577 bypass.
- Public exploit code released for unauthenticated pre-auth RCE in unpatched vBulletin forum software; no account or admin access required for successful code execution.
- GitHub and PyPI have deployed new supply-chain protections including a three-day cooldown on automated pull requests and rejection of uploads to stale releases.
Top Threats Today
1. Dysphoria IoT Botnet Reaches 200k Devices with Blockchain C2 Resilience
Severity: HIGH Affected: Technology
Dysphoria, an Internet of Things botnet tracked by CNCERT and XLab, has infected approximately 200,000 devices worldwide and now uses blockchain-based name services and infected-device relays for command-and-control [2]. The botnet adopted this distributed architecture following a March 2026 law-enforcement operation against JackSkid infrastructure, making it significantly harder ⚠ to disrupt through traditional DNS or domain seizure tactics [1]. The design leverages compromised devices as intermediate relays, obscuring the attacker's control infrastructure.
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Scan IoT device inventory for suspicious outbound blockchain-related traffic or uncommon peer-to-peer connections
- Isolate suspected Dysphoria-infected devices and conduct forensic imaging before remediation
- Monitor for DDoS activity originating from internal IoT assets, particularly smart TVs, routers, and cameras
- Deploy network segmentation to restrict IoT device communication to necessary management and update channels only
2. Arista VeloCloud Orchestrator Zero-Day Under Active Exploitation
Severity: HIGH Affected: Technology
Arista has released patches for a maximum-severity command-injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in attacks [1]. The flaw affects the SD-WAN orchestration platform; organizations running unpatched Orchestrator instances are at immediate risk.
Sources:[1] BleepingComputer
Recommended Action
- Identify all on-premises VeloCloud Orchestrator instances in your environment
- Retrieve and apply Arista’s security patches immediately
- Review access logs and API calls to Orchestrator during the past 30 days for signs of exploitation
- Restrict network access to Orchestrator management interfaces to authorized administrator IPs only
3. n8n Sandbox Escape RCE in Workflow Automation Platform
Severity: HIGH Affected: Technology
n8n has patched a high-severity expression-sandbox escape vulnerability that allows an authenticated workflow editor to execute operating-system commands on the server running the automation platform [1]. The flaw was discovered by Security Joes while testing another bypass of n8n’s February fix for CVE-2026-27577 [1]; this indicates a pattern of sandbox weakness in the platform’s expression evaluation logic.
Sources:[1] The Hacker News
Recommended Action
- Update n8n to the patched version immediately
- Audit workflow editor roles and restrict access to users requiring automation authoring capabilities
- Review audit logs for any expressions executed by internal or external editors in recent workflows
- Consider implementing additional sandboxing or runtime restrictions for workflow execution environments
4. vBulletin Public Exploit for Pre-Auth Code Execution
Severity: HIGH Affected: Technology
Public exploit details released on July 27, 2026 demonstrate how an unauthenticated request can reach PHP’s eval() function inside vBulletin and execute arbitrary ⚠ code on unpatched forum servers [1]. The attack requires no user account, administrative access, or user interaction, making it trivial for attackers to compromise exposed installations [1].
Sources:[1] The Hacker News
Recommended Action
- Immediately inventory all vBulletin forum installations accessible from the internet
- Apply the vendor’s security patch or disable public forum access until patching is complete
- Search web server and application logs for suspicious unauthenticated requests to eval() or similar code-execution endpoints
- Consider blocking forum access at the perimeter until all instances are patched
5. Supply-Chain Security Hardening on GitHub and PyPI
Severity: MEDIUM Affected: Technology
GitHub has implemented a three-day cooldown window before Dependabot opens automated pull requests, and PyPI now rejects file uploads to releases older than 14 days [1]. These defensive measures aim to reduce the risk of supply-chain poisoning by automated tooling and stale-release manipulation.
Sources:[1] SecurityWeek
Recommended Action
- Review and document your dependency-update workflow in light of GitHub’s new Dependabot timing
- Ensure package publishing processes enforce version controls and verify release timeliness before upload
Ongoing Coverage
- FastJson RCE, Microsoft Patch Tuesday (570 vulns), PTC Windchill ransomware, GitHub credential leak: See earlier coverage for continuity.
Today’s Action Checklist
- ☐ URGENT: Patch Arista VeloCloud Orchestrator on-premises deployments and review access logs for exploitation signs.
- ☐ URGENT: Locate and patch all vBulletin forum instances or restrict public internet access.
- ☐ Update n8n to latest patched version and audit workflow editor permissions.
- ☐ Scan network for Dysphoria botnet indicators: blockchain-related traffic from IoT devices, unusual peer-to-peer communication.
- ☐ Document Dependabot cooldown timing changes and adjust CI/CD dependency-update workflows.