24/10/2026 Cyber Security Briefly News - Critical Vulnerability Exploitation and Social Engineering Surge Demand Immediate Defensive Action

📋 Top Headlines at a Glance

CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
Friday Squid Blogging: Increasing Squid Populations
Trust Is Not What It Seems — And Fraudsters Are Counting on It
Abandoned Popcorn Time app exposed millions of devices to RCE attacks
PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches

Executive Summary: Today’s intelligence highlights a critical and immediate threat landscape dominated by actively exploited vulnerabilities in widely used enterprise software and a significant uptick in sophisticated social engineering tactics leveraging artificial intelligence. Organizations must prioritize rapid patching for CISA-flagged flaws, enhance identity verification processes, and address risks associated with unmaintained software to counter pervasive code execution threats and evolving fraud schemes.

🌍 Technical Intelligence Breakdown

🚨 CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Immediate action is required for affected systems.

Affected Products:
- Collabora Online Built-in CODE Server
- Arista VeloCloud Orchestrator (VCO)
Key Vulnerability:
- CVE-2026-110447 (CVSS score: 9.2) is identified as a critical operating system flaw. Dataset provides limited detail on the exact nature of the flaw beyond its critical severity and active exploitation.
Defensive Actions:
- Organizations using Collabora Online Built-in CODE Server or Arista VeloCloud Orchestrator (VCO) must immediately identify and patch all instances.
- Prioritize patching efforts for systems exposed to the internet.
- Monitor CISA’s KEV catalog for additional actively exploited vulnerabilities.

🦑 Friday Squid Blogging: Increasing Squid Populations

Dataset provides limited detail on cybersecurity relevance for this item. The content discusses an increase in squid populations attributed to overfishing of predators and warming sea temperatures, as reported in Nature. While not directly a cyber threat, this serves as a general reminder for vigilance.

Defensive Actions:
- Maintain general situational awareness across all operational domains.
- Encourage open discussion within security teams about emerging threats and overlooked risks.

🎭 Trust Is Not What It Seems — And Fraudsters Are Counting on It

Threat actors are increasingly bypassing traditional malware-based attacks by exploiting human trust and organizational processes. This shift emphasizes social engineering as a primary attack vector.

Attack Vector: Fraudsters are directly engaging help desks, leveraging social engineering to request access to systems or accounts.
Enabling Technology: Artificial intelligence (AI) is being utilized to enhance the sophistication and effectiveness of these social engineering attempts.
Impact: Organizations face breaches without the presence of traditional malware, making detection challenging for endpoint security solutions alone.
Defensive Actions:
- Implement stringent identity verification protocols for all help desk and support interactions, especially for access requests.
- Conduct regular security awareness training focused on social engineering tactics, including AI-enhanced impersonation.
- Strengthen multi-factor authentication (MFA) requirements for all critical systems and services.

🍿 Abandoned Popcorn Time app exposed millions of devices to RCE attacks

An abandoned application, Time4Popcorn (a fork of the Popcorn Time BitTorrent client), contained a critical vulnerability in its updater mechanism, exposing millions of devices to remote code execution (RCE) attacks.

Vulnerability: A flaw in the application’s updater allowed for the execution of malicious code with elevated privileges.
Scope: Millions of computers were potentially vulnerable due to the widespread use of the abandoned application.
Resolution: Researchers successfully disabled the vulnerable updater remotely, mitigating the immediate threat.
Defensive Actions:
- Conduct a comprehensive inventory of all installed software within the environment.
- Identify and remove any abandoned, unsupported, or unnecessary applications.
- Implement strict application control policies to prevent the installation of unauthorized software.
- Regularly review third-party software dependencies for maintenance status and known vulnerabilities.

💻 PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches

PHP has issued a warning regarding a new code execution vulnerability, CVE-2026-115560, shortly after releasing emergency patches for the PHP2Shell flaws. This new vulnerability affects specific PHP configurations.

Vulnerability Type: Code execution flaw, tracked as CVE-2026-115560.
Context: Discovered just days after patches for critical PHP2Shell vulnerabilities.
Affected Configuration: The vulnerability impacts only a specific PHP configuration. Dataset provides limited detail on the exact configuration specifics.
Mitigation Advice: PHP advises disabling “session upload progress” until a permanent fix is released.
Defensive Actions:
- Review all PHP configurations to identify if the vulnerable “session upload progress” feature is enabled.
- Disable “session upload progress” immediately as a temporary mitigation.
- Monitor PHP official security advisories for patch availability and apply updates promptly.
- Implement least privilege principles for all web server configurations and PHP installations.

📉 Threat Landscape & Trends

Persistent Active Exploitation: Critical vulnerabilities, particularly those flagged by CISA, are under active attack, demanding immediate patching and robust vulnerability management programs.
Evolving Social Engineering: Threat actors are increasingly relying on human-centric attacks, leveraging sophisticated social engineering and AI to bypass technical controls and target help desks for unauthorized access.
Software Lifecycle Risks: Abandoned or unmaintained software poses significant and widespread security risks, leading to unpatched vulnerabilities that can be exploited for remote code execution.
Code Execution Remains a Top Threat: Multiple reports highlight code execution flaws in widely used software components (Collabora Online, PHP, Popcorn Time fork), underscoring the need for secure coding practices and diligent patching.
Configuration Management Criticality: Specific configurations can introduce vulnerabilities, emphasizing the importance of secure default configurations and careful review of custom settings.

📌 Strategic Takeaway

Organizations must adopt a multi-layered defense strategy that prioritizes rapid response to actively exploited vulnerabilities, fortifies human defenses against advanced social engineering, and rigorously manages software assets throughout their lifecycle to mitigate pervasive code execution risks.