Arista EOS CVE-2026-7473: still unfixed, and no fix is coming
Arista's tunnel decapsulation flaw has been on CISA's KEV list since June, and Arista says no software fix is planned. Find the exposed switches and fence them with ACLs.
Alert
Actively exploited vulnerabilities and live incidents we are tracking. Every alert is also listed, with its status, on our Alert Tracker.
LiteLLM 1.107.0 was poisoned: rotate every secret it could reach
A hijacked LiteLLM release pipeline pushed a credential stealer to PyPI and Docker for about two hours on 21 October. Rebuild on 1.106.2 and rotate secrets.
SafePay: joint advisory on a ransomware crew with 600-plus victims
FBI, CISA, NCA and German police detail SafePay: old edge-device CVEs, legitimate tools, NAS backups reset to factory settings and phone calls to victims.
Plex2Shell is being exploited: patch Plex, then assume compromise
A four-bug Plex Media Server chain is planting miners. The fix shipped in August; exposed servers older than 1.43.3.10861 should be treated as compromised.
ConnectWise Cloud Backup: Storm-0940 and an AI-paced supply-chain attack
Microsoft links the ConnectWise Cloud Backup compromise to Storm-0940 and the ARTEX framework. Export your Entra logs before retention eats the evidence.
PHP2Shell: patch PHP now, then go hunting
Two critical PHP flaws allow unauthenticated RCE, and attackers were probing before the fix. Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then hunt.
