The Whistle: Special Bulletin - VeloCloud, Collabora CODE, Prime Mover, and Python's CA Denylist
Between digests: two KEV additions sit on management planes under active attack, a WordPress plugin whose fix beat its advisory, and a 9.4 on CPython’s ssl.
VeloCloud Orchestrator: a login becomes a superuser
Arista’s Advisory 0199 (October 22) documents SQL injection CVE-2026-114625 (CVSS v3.1 9.9, v4.0 9.4) in on-prem VeloCloud Orchestrator, the SD-WAN control plane. Any authenticated user, down to the lowest tenant role, masquerades as a “superuser operator” and reaches internal-only functionality. Arista: “no configuration that can prevent the exposure,” “known to be actively exploited.” CISA KEV listed it on October 23; Arista lists attacker IPs 74.82.197.86 and 38.54.50.151 to hunt and block. Affected trains: 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, and 6.4.x before 6.4.2.12. July’s CVE-2026-16812 and September’s CVE-2026-93952 fixes do not cover it; hosted instances are already patched; Gateway/Edge are unaffected. Verify the running version, restrict the interface to administrative networks, and review recent admin activity before remediating.
Collabora CODE: the exploit window is your restart window
CVE-2026-110447 is an unauthenticated OS command injection (CWE-78, CVSS v4.0 9.2) in proxy.php of richdocumentscode, the Collabora “Built-in CODE Server” app bundled with Nextcloud. It fires while the local document server is down; restarts, upgrades, and crashes are the attack windows. First reports arrived September 10 in a GitHub issue; The Hacker News describes PHP web shells such as shrf4645.php in the app directory, attackers hunting password-manager data and cryptocurrency wallets; the CVE record marks exploitation in the wild through September and October, and CISA listed it in KEV on October 23. The fix is richdocumentscode 26.4.303; the advisory is blunt: disabling the app does not close the hole, so upgrade or remove. Nextcloud 29 and older cannot install the fixed app, so upgrade Nextcloud or drop it; standalone Collabora servers are unaffected. Diff apps/richdocumentscode/ for PHP files you did not ship, and alert on CODE downtime, the quiet state the attacker wants.
Prime Mover: the patch landed before the press release
Wordfence published the advisory October 22 for Prime Mover (10,000+ installs): versions through 2.2.1 deserialize untrusted data in migration search-and-replace (CVE-2026-115806, CVSS 9.8). On a site with commenting open, an unauthenticated visitor stores a base64-encoded serialized object in the comments table through the ordinary comment endpoint; the next admin-run export or restore unserializes it with no allowed_classes restriction. The gadget chain ships in the bundled Freemius library and ends in update_option(). Wordfence’s record read “no known patch” on October 23, yet 2.2.2 (released October 20) carries the changelog line “hardened unserialize implementation to prevent object injection (Credit: Civitasmass/Wordfence),” and the SVN diff swaps plain @unserialize() for a hardened wrapper. Update to 2.2.2 and verify the changelog rather than one database’s patched flag. It is the plugin’s third CVE round this month, so if it does not carry your backups, question keeping it.
CPython: the eMudhra keys earn their own CVE
The October 21 bulletin covered the eMudhra intermediates whose keys need no theft (values as small as 4, recoverable since April 2025). On October 24 the PSF published CVE-2026-115557 (CVSS 9.4, CWE-299): ssl performs no revocation check, so handshakes chain through the compromised keys until a trust store updates. The interpreter fix mirrors Go’s: an SPKI digest denylist merged into main hours before the record went out; no release carries it yet. certifi 2026.10.19, pip 26.2.2, and current OS bundles do the rest.
Patch the orchestrator first (it holds the keys to every branch site), diff the CODE app directory second, bump the WordPress plugin last, then refresh certifi and pip. Something wrong here, or a stronger opinion? info@stackref.com always works.
This post was created with a Hermes AI agent (hermesagent.ai) from a weekly news gathering workflow, then reviewed and approved by Keith before publication.