October 26, 2026 is shaping up to be one of the more consequential days of the year for defenders. CISA has added two new entries to its Known Exploited Vulnerabilities catalog, a widespread PHP flaw is actively taking down websites and enabling server takeovers at scale, and a sophisticated UEFI bootkit is quietly undermining endpoint security tools in espionage operations. Taken together, these items paint a picture of threat actors moving fast across multiple attack surfaces simultaneously — and security teams need to move faster.

Starting with the most targeted enterprise infrastructure: CISA has flagged CVE-2026-114625, a critical SQL injection vulnerability in the Arista VeloCloud Orchestrator. VeloCloud is widely deployed as an SD-WAN management platform, meaning this orchestrator sits at the heart of network routing decisions for many mid-to-large enterprises. SQL injection at this layer is not a minor inconvenience — it can expose configuration data, credentials, and potentially allow an attacker to manipulate network paths or pivot deeper into the environment. If your organization runs VeloCloud Orchestrator, this patch is not optional and not next-sprint work. It is today's work.

Alongside it, CVE-2026-110447 affects Collabora Online's built-in CODE Server and is classified as an OS Command Injection vulnerability. Collabora Online is a popular open-source office suite often self-hosted by organizations seeking alternatives to cloud productivity platforms, including many government and education environments. OS command injection at the server level means an unauthenticated or low-privilege attacker could execute arbitrary system commands, effectively owning the host. Given that Collabora instances are frequently internet-facing, the exposure surface is significant.

The PHP situation deserves its own paragraph because of its sheer scale. CVE-2026-109618 and CVE-2026-109619, collectively referred to in the wild as the PHP2Shell vulnerabilities, affect close to 70 percent of websites running PHP — a staggering proportion of the internet's server-side infrastructure. Researchers are already observing widespread scanning and active exploitation, with at least one confirmed intrusion against a European government entity. What makes this particularly alarming is reporting that threat actors are leveraging agentic AI platforms to accelerate post-exploitation activity. This means the window between initial access and lateral movement or data exfiltration is compressing. Defenders cannot assume they have days to respond once a PHP server is compromised; the adversary's AI-assisted playbook may complete its objectives in hours.

Finally, the BlackX UEFI bootkit represents a different category of threat — one aimed at persistence and stealth rather than immediate exploitation. BlackX exploits the Baton Drop vulnerability to bypass Secure Boot, allowing it to load a malicious driver before the operating system initializes. This driver is specifically engineered to interfere with security products from Kaspersky and Avast, effectively blinding endpoint defenses before they can start. UEFI-level threats are particularly dangerous because they survive OS reinstallation and are invisible to most traditional endpoint detection tools. The espionage context suggests a nation-state or sophisticated criminal actor with long-term access objectives.

Defensive Priorities

- Patch Arista VeloCloud Orchestrator immediately for CVE-2026-114625. Restrict management interface access to trusted IP ranges and audit database query logs for anomalous patterns indicative of SQL injection attempts.

- Patch or isolate Collabora Online instances for CVE-2026-110447. If patching cannot happen today, take internet-facing instances offline or place them behind a WAF with strict input validation rules. Review server process logs for unexpected child process spawning.

- Audit all PHP versions across your environment for CVE-2026-109618 and CVE-2026-109619. Prioritize internet-facing PHP applications. Deploy WAF rules targeting PHP2Shell exploitation patterns and increase monitoring on web server logs for shell command indicators in request parameters. Assume any unpatched PHP server exposed to the internet may already be compromised and initiate threat hunting accordingly.

- For BlackX and UEFI bootkit threats, verify that Secure Boot is properly configured and that UEFI firmware is updated to the latest vendor-supplied version with Baton Drop mitigations applied. Enable UEFI Secure Boot attestation logging where available. Investigate any endpoint where security tooling has become unexpectedly disabled or degraded, as this may indicate bootkit activity rather than a software fault.

- Increase log retention and SIEM alerting sensitivity across all affected product categories for the next 72 hours. Given the AI-assisted post-exploitation activity observed in PHP2Shell campaigns, prioritize alerts around credential access, lateral movement, and data staging behaviors.

- Brief incident response teams now. The combination of active CISA KEV entries and confirmed government-sector targeting means escalation paths should be pre-cleared before an incident is confirmed, not after.

The convergence of network infrastructure flaws, collaboration platform vulnerabilities, mass web server exploitation, and firmware-level persistence in a single day is a reminder that adversaries do not wait for convenient timing. Defenders who treat any one of these items as lower priority risk providing exactly the foothold attackers are looking for.

This briefing is informational and intended to supplement, not replace, official vendor advisories and CISA guidance for the vulnerabilities discussed.