cybr.cx Daily Digest — October 26, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-114625 | Arista VeloCloud Orchestrator | CVSS: TBA
A SQL injection vulnerability in Arista's VeloCloud Orchestrator (on-prem deployments) allows remote attackers to access privileged internal functionality, with full compromise of confidentiality, integrity, and availability on the table. CISA added this to the KEV catalogue on October 23 with a remediation deadline of today — if you haven't patched, you're already overdue. Network operators running SD-WAN infrastructure should treat this as an emergency.

⚠️ Actively exploited — CVE-2026-110447 | Collabora Online Built-in CODE Server (Nextcloud) | CVSS: TBA
When the built-in CODE server isn't running within a Nextcloud deployment, an OS command injection flaw allows remote code execution — no authentication required. This is a particularly nasty trigger condition: the vulnerability is exploitable precisely when the service is in a degraded state, making it easy to miss in monitoring. Patch or isolate Nextcloud+Collabora stacks immediately.

⚠️ Actively exploited — CVE-2026-96652 / 96654 / 96655 / 96656 | Plex Media Server | CVSS: TBA
Four chained vulnerabilities in Plex Media Server are being actively exploited together. The chain combines two SSRF flaws (one requiring only any valid X-Plex-Token), a URI scheme injection that allows cross-plugin function calls, and an arbitrary file write that executes on load — together enabling full server compromise from an authenticated (or lightly credentialed) position. Self-hosted Plex users should update immediately and audit externally exposed instances.

⚠️ Actively exploited — CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition | CVSS: TBA
An OS command injection in SiteGuard Server Edition allows arbitrary command execution with root or SYSTEM privileges. The product's remediation deadline has already passed (October 23). Operators running this WAF product should check vendor advisories and apply mitigations without delay.

⚠️ Actively exploited — CVE-2026-110936 | Siemens Software Center | CVSS: TBA
An uncontrolled search path element vulnerability allows an authenticated local attacker to plant a crafted DLL and achieve code execution at the application's privilege level. While local access is required, the industrial and OT environments where Siemens software is common make this a meaningful lateral movement risk.

CVE-2026-116068 | Dokploy ≤ 0.30.10 | CVSS: 8.8
An authorization bypass lets any organisation owner or admin supply foreign applicationId values to cross tenant boundaries, enabling them to overwrite environment variables, build secrets, reconfigure Traefik routing, and deploy or stop other tenants' applications. Multi-tenant Dokploy deployments are fully exposed until upgrade to 0.30.11 or later.

CVE-2026-116201 | Snipe-IT < 8.5.0 | CVSS: 8.8
A race condition in the SAML ACS handler allows a single captured assertion to be replayed via concurrent POST requests to /saml/acs, spawning multiple authenticated sessions — all of which survive IdP-side revocation. Organisations using SAML SSO with Snipe-IT for asset management should prioritise the upgrade to 8.5.0.

CVE-2026-116199 | Snipe-IT < 8.6.3 | CVSS: 8.1
A separate Snipe-IT flaw: Google SSO login ignores the activated flag, allowing deactivated users — including former admins — to regain full sessions via a live Google identity. A second critical reason to get current on Snipe-IT versions this week.

CVE-2026-116211 | YesWiki 4.5.0–4.6.x | CVSS: 8.2
Unauthenticated SQL injection via the date_maj_fiche field in Bazar entry creation — the value is concatenated raw into an INSERT statement, and a sub-SELECT can exfiltrate wiki_users password hashes on default installs. Update to 4.7.0.

CVE-2026-116149 | ImageMagick < 6.9.13-58 / < 7.1.2-33 | CVSS: 8.1
A stack-based buffer overflow triggered by crafted bzip2-compressed images during decoding. Any pipeline that processes untrusted images through ImageMagick is potentially exposed to crash or memory corruption. Given how widely ImageMagick is embedded in web stacks and CI pipelines, patch surface here is broad.

CVE-2026-116176 | vLLM 0.9.2–0.23.x | CVSS: 8.2
An SSRF in vLLM allows API callers to embed a decode address in the X-Request-Id header, forcing a prefill worker to ZMQ-connect to an attacker-controlled host — leaking NCCL unique_id values and KV-cache tensors, or blocking the worker entirely. LLM inference infrastructure is increasingly in scope for security teams; update to 0.24.0.

Headline News

Plex Chain Exploit and the Self-Hosted Blind Spot

The four Plex Media Server CVEs now confirmed as actively exploited in the wild represent a textbook example of vulnerability chaining: individually moderate issues combining into a full-compromise path. The attack begins with SSRF reachable using any valid X-Plex-Token — a low bar in environments where tokens are shared or leaked — escalates through URI scheme injection to invoke arbitrary plugin functions, and terminates with a file write primitive that executes on next load. What makes this operationally significant is the population at risk: self-hosted Plex is ubiquitous in home labs and small businesses, environments that often lack EDR coverage or timely patch cycles. The presence of four related CVEs on the CISA KEV list simultaneously signals that threat actors have working exploit chains, not just proof-of-concept code. If Plex is running anywhere on your network — especially exposed to the internet — treat this as incident response, not routine patching.

Keystone Hardware Wallet Website Breach Exposes Customer Data

Keystone, a manufacturer of air-gapped hardware wallets, has confirmed that its marketing website was compromised and customer data exposed. The breach is notable for the specific irony it presents: a company whose core value proposition is protecting crypto assets from network-based attacks suffered a conventional web breach affecting its customer-facing infrastructure. While the hardware wallet devices themselves appear unaffected, the exposed data — names, email addresses, and potentially order details — creates a high-value phishing and social engineering list targeting an audience known to hold significant cryptocurrency. Practitioners should note this as a reminder that supply-chain and brand trust attacks against security vendors are a deliberate threat actor strategy; customers of hardware security products are attractive targets precisely because of their likely asset values and security awareness profiles.

Ransomware Hits Telangana's TG-iPASS Investment Portal

A ransomware attack against India's Telangana State Industrial Project Approval and Self-Certification System (TG-iPASS) encrypted the portal's database hosted on Cloud4C infrastructure, taking the government investment facilitation platform offline. The Telangana Cyber Security Bureau has opened an investigation under the IT Act, and authorities indicate backups are available with restoration expected imminently. The incident is a useful case study in cloud-hosted government infrastructure risk: the attack vector has not been publicly confirmed, but the rapid encryption of cloud-hosted database assets is consistent with credential compromise or exposed management interfaces rather than sophisticated zero-day exploitation. For practitioners advising public sector clients, this reinforces the critical importance of immutable backup architectures and network segmentation even in managed cloud environments.

Schrödinger's Feed

China's Neutral-Atom Push: Hardware Records, but System-Level Questions Remain

A comprehensive review of China's neutral-atom quantum computing ecosystem reveals significant hardware milestones — world-record atom array sizes, high-fidelity gate operations, and commercially available systems built on domestic supply chains. The findings suggest China has pulled ahead of Western programs on some raw physical parameters, though the review notes meaningful gaps in system-level integration and software maturity where US and European efforts retain an edge. From a security standpoint, neutral-atom platforms are increasingly relevant to the cryptographic threat timeline: they represent a viable alternative path to fault-tolerant quantum computation that doesn't depend on the superconducting qubit roadmaps most Western post-quantum planning has implicitly assumed. Practitioners overseeing long-horizon cryptographic migration programmes should treat this as a signal to revisit their "harvest now, decrypt later" threat models — the assumption that capable quantum hardware is a decade away deserves regular stress-testing.

/dev/random

JetBrains Ships a Train Simulator. In the IDE. Sort Of.

JetBrains — the company responsible for IntelliJ, PyCharm, and the IDE that quietly runs half the world's enterprise Java — has released Thinkrail, a train simulation game built entirely within the JetBrains plugin ecosystem. It's not a joke project: the game runs inside the IDE itself, apparently because developers spending eight hours staring at code deserve the option to also spend eight hours staring at procedurally generated rail networks without alt-tabbing. There is something deeply on-brand about a developer tooling company deciding the correct response to IDE fatigue is more IDE. No CVEs filed yet, but give it time — someone will find a way to exfiltrate environment variables through the train horn.