Arista VeloCloud zero-day exploited; Railway, Capcom breaches; LiteLLM supply chain attack

Arista VeloCloud Orchestrator zero-day SQL injection is actively exploited; Railway platform users must rotate secrets immediately; Capcom confirms numerous account breach; LiteLLM supply chain compromised with credential-stealing malware. Patch and rotate credentials across all affected systems today.

Arista Networks patched an actively exploited SQL injection zero-day in VeloCloud Orchestrator (VCO) central management systems used for SD-WAN networks.

Railway, a cloud platform for hosting application environment variables, detected suspicious activity and warns users to rotate secrets immediately.

Capcom confirmed hackers breached its CAPCOM ID membership service, exposing 11.7 million customer email addresses and associated information.

LiteLLM's release pipeline was compromised; attackers published malicious PyPI packages and Docker images containing credential and secrets-stealing malware.

Microsoft issued patches for more than 1,400 security vulnerabilities across Windows and enterprise software.

1. Arista VeloCloud Orchestrator SQL Injection Zero-Day Under Active Exploitation

Severity: CRITICAL Affected: Technology

Arista Networks released security updates to patch a SQL injection zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments that is being actively exploited in attacks [1] [2] . The flaw allows an attacker who can log in to the orchestrator—even with read-only credentials—to execute arbitrary SQL commands [1] . VeloCloud is the central management system for VeloCloud SD-WAN networks, which are widely deployed in enterprise environments [1] . Arista assigned four CVE identifiers to related vulnerabilities: CVE-2026-114625, CVE-2026-7473 , CVE-2026-16812 , and CVE-2026-93952 [2] . Sources: [1] The Hacker News [2] BleepingComputer

Immediately apply Arista's published security updates to all VeloCloud Orchestrator On-Prem instances.

Review access logs for suspicious SQL queries or unauthorized authentication attempts.

Audit and restrict VCO access to only users requiring management privileges; revoke read-only accounts if not actively in use.

Monitor for unusual outbound traffic or data exfiltration from VCO systems.

2. Railway Cloud Platform Warns of Potential Breach; Developer Secrets Exposed

Severity: HIGH Affected: Technology

Railway, a cloud platform that stores customer environment variables and secrets, detected suspicious activity on its systems earlier this week and published an urgent warning to users [1] . Environment variables typically contain API keys, database passwords, and other credentials used to access internal systems ⚠ [1] . Sources: [1] BleepingComputer

Log into Railway immediately and rotate all stored secrets, API keys, and database credentials.

Audit logs to determine which secrets may have been exposed and what systems they control.

Review and revoke any credentials that accessed sensitive internal systems during the suspicious activity period.

Enable multi-factor authentication and IP whitelisting on Railway accounts if available.

3. Capcom CAPCOM ID Membership Service Breached; 11.7 Million Accounts Exposed

Severity: HIGH Affected: Retail

Japanese gaming giant Capcom confirmed that hackers breached its CAPCOM ID membership service, exposing more than 11.7 million customer email addresses and associated information [1] . The breach affects the centralized account system used by Capcom players worldwide. Sources: [1] BleepingComputer

If you have a CAPCOM ID account, change your password immediately and enable multi-factor authentication.

Monitor for phishing emails claiming to be from Capcom or using exposed email addresses.

If your email was exposed, watch for credential stuffing attempts on other services; consider a credit freeze if financial data was accessible.

Organizations: block known Capcom phishing indicators and educate employees the breach.

4. LiteLLM Supply Chain Compromise: Malicious PyPI and Docker Packages Distribute Info-Stealer

Severity: CRITICAL Affected: Technology

Hackers compromised the LiteLLM project's release pipeline and published malicious versions on PyPI (Python Package Index) and Docker Hub with payloads designed to steal credentials, secrets, and environment variables [1] . LiteLLM is a Python library used by developers to integrate large language models into applications; any organization or developer using a compromised version would ⚠ have secrets exfiltrated to attacker-controlled systems [1] . Sources: [1] BleepingComputer

Immediately audit all Python environments and container deployments for LiteLLM versions installed between the compromise window and patch release.

Rotate all API keys, database passwords, and secrets that may have been stored in environment variables on affected systems.

Review network logs for data exfiltration to unknown external IPs during the compromise period.

Update to the latest verified LiteLLM release from an official source and verify package integrity.

Implement package verification and signed dependency checks in your CI/CD pipeline to detect future compromises.

5. Microsoft Patches 1,400+ Vulnerabilities in Windows and Enterprise Software

Severity: HIGH Affected: Technology

Microsoft issued updates to fix more than 1,400 security vulnerabilities in Windows operating systems and other software [1] . This patch batch significantly exceeds the September record of nearly 1,000 fixes, indicating a substantial vulnerability backlog [1] . CVE-2026-108398 and CVE-2026-96951 are among the vulnerabilities patched [1] . Sources: [1] Krebs on Security

Prioritize patching Windows systems and Microsoft enterprise products (Exchange, Office, Azure services) in your environment.

Test critical patches in a staging environment before broad deployment to avoid service disruption.

Deploy patches in waves to high-risk systems (internet-facing servers, domain controllers, email systems) first.

Monitor for exploitation attempts targeting CVE-2026-108398 and CVE-2026-96951 in particular.

Today’s Action Checklist

☐ URGENT: Apply Arista VeloCloud Orchestrator security patches to all On-Prem instances; review access logs for signs of exploitation.

☐ URGENT: If using Railway platform, rotate all stored secrets and API keys immediately.

☐ URGENT: Audit Python and container environments for compromised LiteLLM versions; rotate all exposed credentials.

☐ PRIORITY: Test and deploy Microsoft security updates to Windows and enterprise software in your estate.

☐ PRIORITY: If you have a CAPCOM ID account or operate Capcom services, reset passwords and enable MFA; watch for phishing.