Three zero-days in four months on the same SD-WAN management platform. A Chinese APT compressing breach timelines to three hours with agentic AI. A second PHP RCE with no fix planned. And yet another AI supply chain package poisoned. Today’s brief covers the stories that will drive customer conversations this week.

In the News

Third VeloCloud Orchestrator Zero-Day Exploited in the Wild

Arista released an emergency patch for a SQL injection vulnerability in VeloCloud Orchestrator (VCO) that allows any authenticated customer-level account to escalate to full operator privileges. The vulnerability is being actively exploited in the wild.

This is the third VCO zero-day since June 2026. The pattern is now unmistakable: the VeloCloud Orchestrator management plane has become a persistent target for attackers who understand that compromising the orchestrator means compromising every SD-WAN edge device it manages. Each vulnerability has been a different bug class - authentication bypass in June, path traversal in August, SQL injection now - which suggests attackers are methodically auditing the platform rather than stumbling onto individual flaws.

The immediate risk is privilege escalation. A customer-level account - the kind provisioned for every tenant on a multi-tenant VCO deployment - can reach operator-level control, which typically includes the ability to push configuration changes to edge devices, modify routing, and access other tenants’ data. For managed service providers running multi-tenant VCO, this is a tenant isolation failure.

What defenders should do: Patch VCO immediately. If patching requires a maintenance window, restrict management plane access to known administrative IP ranges and audit VCO authentication logs for anomalous privilege escalation. Review whether SD-WAN orchestrator access is segmented from production tenant traffic. Source: SecurityWeek

Storm-0940 Used Agentic AI to Breach 2,200 MSP Tenants in 3 Hours

Microsoft publicly confirmed that Storm-0940, a Chinese state-sponsored threat actor, used ARTEX - an autonomous AI penetration testing framework - during the ConnectWise supply chain compromise that affected more than 2,200 managed service provider tenants. The AI-driven toolchain automated the full kill chain from initial access through privilege escalation, compressing what historically took days into approximately three hours.

This is the first publicly confirmed case of a nation-state APT using agentic AI as a tactical force multiplier in a real-world operation. ARTEX reportedly handled reconnaissance, vulnerability identification, exploitation, and lateral movement autonomously, with human operators intervening only for strategic decisions about target prioritization. The 3-hour breach-to-privilege timeline means that detection and response workflows built around next-business-day analyst triage are structurally inadequate against this class of attack.

The supply chain vector amplified the impact. By compromising ConnectWise - a platform that MSPs use to manage their customers’ environments - Storm-0940 gained downstream access to thousands of end-customer networks through trusted administrative channels. This is MITRE ATT&CK T1199 (Trusted Relationship) combined with T1059 (Command and Scripting Interpreter) at machine speed.

What defenders should do: Assess third-party MSP access controls immediately. Implement automated detection and response playbooks that can contain lateral movement without waiting for human triage. Audit ConnectWise integration permissions and rotate credentials if your MSP uses ConnectWise for remote management. Source: SecurityWeek

PHP Discloses Second RCE - No Fix Planned

Forty-eight hours after the PHP2Shell emergency patches forced millions of web servers through urgent remediation, the PHP project disclosed CVE-2026-115560 - a second, distinct remote code execution path. The PHP security team stated the vulnerability affects specific, uncommon web server configurations and no emergency patch is planned.

The “uncommon configurations” caveat deserves scrutiny. PHP2Shell also initially appeared to affect a narrow set of deployments before exploitation proved the vulnerable surface was broader than anticipated. Defenders who just finished PHP2Shell remediation now need to validate whether their server configurations fall into the affected category for CVE-2026-115560. Without a vendor patch, web application firewalls with virtual patching capabilities become the primary compensating control.

The compounding effect matters: two PHP RCE disclosures in 48 hours means every organization running PHP-based web applications - which is a substantial portion of the internet - is reassessing its PHP exposure right now. Expect this to dominate web security conversations for the rest of the week.

What defenders should do: Audit web server configurations against the specific parameters described in the CVE-2026-115560 advisory. Deploy WAF rules for virtual patching. If running PHP in production, ensure PHP2Shell patches are fully applied and monitor for exploitation indicators on both vectors. Source: The Hacker News

LiteLLM AI Gateway Compromised in Supply Chain Attack

LiteLLM, a popular Python package used as an AI gateway to proxy requests across multiple large language model providers, was compromised through leaked GitHub tokens. Version 1.107.0 on PyPI and the official Docker image contained a credential stealer and backdoor that exfiltrated API keys and environment variables from AI developers who installed the package.

This is the third major software supply chain attack disclosed this week, following the Railway PaaS breach and the ongoing fallout from earlier npm compromises. The LiteLLM attack is particularly concerning because the package sits at a trust boundary - it handles API keys for OpenAI, Anthropic, Azure, and other LLM providers, making it a high-value target for credential theft.

The attack vector - leaked GitHub tokens used to hijack the release pipeline - is a pattern that keeps recurring. Organizations building AI applications need to treat their AI toolchain dependencies with the same rigor applied to production infrastructure dependencies: pinned versions, verified checksums, and automated scanning for compromised packages.

What defenders should do: Check for LiteLLM version 1.107.0 in all environments. If present, rotate all API keys and secrets that LiteLLM had access to. Implement software composition analysis in AI development pipelines and pin package versions with hash verification. Source: SecurityWeek

Defender Action Items

  • VeloCloud Orchestrator: Patch immediately. Restrict management plane access to known admin IPs. Audit authentication logs for privilege escalation from customer-level accounts.
  • ConnectWise / MSP access: Audit third-party remote management permissions. Rotate credentials. Implement automated containment playbooks that trigger on lateral movement indicators without human approval.
  • PHP environments: Validate PHP2Shell patches are applied. Audit server configurations against CVE-2026-115560 advisory parameters. Deploy WAF virtual patching rules for both vectors.
  • LiteLLM: Search for version 1.107.0 across all Python environments and Docker images. Rotate all LLM provider API keys. Pin dependencies with hash verification.
  • Node.js (CVE-2026-111497): Update to latest patched version in each supported branch (22.x, 24.x, 26.x). The Brotli decoder RCE affects every Node-based API.
  • Python Pillow (CVE-2026-112900): Update Pillow and restrict EPS file processing in web applications that handle user-uploaded images.

Detection Spotlight

Storm-0940’s ARTEX toolchain compresses the kill chain to hours. Detection rules that look for rapid sequential privilege escalation across multiple systems - characteristic of automated attack frameworks - can catch this pattern. The following Splunk SPL query identifies accounts that authenticate to more than five distinct hosts within a 30-minute window and perform privilege-related actions on each:

index=windows sourcetype=WinEventLog:Security EventCode IN (4624,4672)
| bin _time span=30m
| stats dc(ComputerName) as host_count values(ComputerName) as hosts by Account_Name _time
| where host_count > 5
| sort - host_count

This query surfaces accounts moving laterally at machine speed - exactly the pattern ARTEX creates. Tune the host_count threshold and time window to your environment. In networks with legitimate admin tools that touch many hosts (SCCM, Ansible), correlate with the source process to reduce false positives. A high-fidelity refinement adds EventCode 4672 (special privileges assigned) to confirm the account is escalating, not just authenticating.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.