VeloCloud Orchestrator CVE-2026-114625: A Read-Only Login Can Become Full Control
Arista VeloCloud SD-WAN Orchestrator has an exploited SQL injection (CVSS 9.9). Any logged-in user, even read-only, can become operator. Fixes and checks.
- Home
- Blog
Tech Blog
Field notes from real incidents: what broke, how we found it, and the fix. No fluff.
Cisco Snort 3 Critical Fixes (October 2026): FTD, Meraki MX and IOS XE UTD
Cisco rated its October 2026 Snort 3 fixes Critical (CVSS 9.0). They affect Secure Firewall FTD, Meraki MX and UTD on IOS XE. Who must act and which versions.
PHP2Shell (CVE-2026-109618): Why Your Firewall Vendor Is Talking About a PHP Bug
PHP2Shell is a pair of PHP bugs allowing code execution without login. Palo Alto says all PAN-OS versions are affected. What each vendor said and what to do.
Ransomware Gangs Are Using GlobalProtect CVE-2026-0257: What to Check
Unit 42 says Qilin and Inc ransomware are exploiting GlobalProtect auth bypass CVE-2026-0257 to get VPN access. The fix, the config change and what to hunt for.
PAN-OS October 2026: CVE-2026-0322 Management RCE and a GlobalProtect Identity Bug
Palo Alto's October advisories: CVE-2026-0322 gives root on the firewall via the management interface and is already attacked, plus GlobalProtect CVE-2026-0319.
Ivanti Connect Secure Zero-Day CVE-2026-104935: What VPN Admins Should Do Now
Another Ivanti VPN zero-day: CVE-2026-104935 lets an unauthenticated attacker run commands. It was exploited before the fix. Versions, fixes and next steps.