October 25, 2026 is a heavy day for defenders. Five critical vulnerabilities span the full stack — from firmware sitting below the operating system all the way up to developer runtimes and collaboration platforms. Two are already confirmed as actively exploited by CISA. The common thread is urgency: these are not theoretical risks sitting in a research paper. They are live threats touching enterprise infrastructure, developer pipelines, and the very boot integrity of endpoints. Security teams should treat today's briefing as a triage call, not background reading.

The most architecturally alarming disclosure is the BlackX UEFI bootkit, which achieves persistent firmware-level compromise on fully patched Windows systems by exploiting gaps in Secure Boot certificate revocations. Secure Boot is widely trusted as a foundational control, and many organizations assume that keeping Windows patched is sufficient. BlackX demonstrates that assumption is dangerous. If the firmware's Secure Boot database still trusts certificates that Microsoft has since revoked — because the revocation was never applied to the device — an attacker can load a malicious bootloader before the OS ever starts. This gives the implant extraordinary persistence and makes it nearly invisible to endpoint detection tools that only operate after boot. Diplomatic targets have already been observed in the wild, suggesting a sophisticated, likely nation-state-aligned threat actor.

On the actively exploited front, CISA has added two vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026-110447 is an OS command injection flaw in the Collabora Online Built-in CODE Server, a widely deployed open-source office suite component used in self-hosted environments. CVE-2026-114625 is a SQL injection vulnerability in Arista VeloCloud Orchestrator, a platform used to manage SD-WAN infrastructure across enterprise and service provider networks. Both flaws carry critical severity ratings, and active exploitation means attackers are already scanning for and compromising unpatched instances. VeloCloud Orchestrator is a particularly high-value target because compromising the orchestration layer can give an attacker visibility into and control over an organization's entire SD-WAN fabric.

The Ruby regex engine (Onigmo) vulnerabilities deserve serious attention from any organization running GitLab. Three bugs in Onigmo enable remote code execution through maliciously crafted regex patterns, and GitLab identified four distinct critical RCE flaws built on top of these weaknesses. GitLab is a crown-jewel asset in most development environments — it holds source code, CI/CD pipelines, secrets, and deployment credentials. An RCE on a GitLab instance is effectively a breach of the software supply chain. Patches are available in Ruby versions 3.3.13, 3.4.12, and 4.0.9, and GitLab has issued corresponding updates.

Finally, CVE-2026-111497 affects Node.js versions including 24.22.0, where a critical RCE vulnerability exists in the bundled Brotli decoder. Researchers demonstrated the Node2Shell exploit, showing that crafted compressed data sent to a vulnerable Node.js process can result in full remote code execution. Any internet-facing Node.js application that accepts compressed input — which is most of them — should be considered at risk until patched.

Defensive priorities for security teams today:

- Verify Secure Boot certificate revocation status on all endpoints immediately. Use vendor tooling or scripts to confirm that the Secure Boot Forbidden Signature Database (dbx) is current. Do not assume Windows Update has handled this automatically — it often has not. Audit firmware integrity using TPM attestation where available and flag any device where the measured boot chain deviates from baseline.

- Patch or isolate Collabora Online and Arista VeloCloud Orchestrator instances without delay. Both CVEs are in CISA's KEV catalog, which means federal agencies have a mandatory remediation deadline and all organizations should treat this with equivalent urgency. If patching cannot happen immediately, restrict network access to these services to trusted IP ranges and increase logging verbosity on those systems.

- Update GitLab and the underlying Ruby runtime to the patched versions. Audit CI/CD pipeline configurations for any user-controlled regex inputs that could be weaponized. Review GitLab access logs for anomalous API calls or unexpected pipeline executions that may indicate prior compromise.

- Upgrade Node.js to a version that addresses CVE-2026-111497. In the interim, implement strict input validation and size limits on compressed data accepted by Node.js services. Consider deploying a web application firewall rule to flag or block unusually structured Brotli-compressed payloads at the perimeter.

- Across all of these threats, ensure your SIEM is ingesting logs from firmware attestation, orchestration platforms, collaboration tools, and application runtimes. Detections for SQL injection patterns in VeloCloud logs, unexpected child process spawning from Collabora or Node.js processes, and anomalous bootloader measurements should be reviewed or created today.

The breadth of today's threat landscape — spanning firmware, network orchestration, developer platforms, and application runtimes — is a reminder that defense-in-depth is not a buzzword. No single control stops all of these. Layered visibility, rapid patching discipline, and network segmentation together reduce the blast radius when one layer fails.

This briefing is informational and intended to support situational awareness; always consult official vendor advisories and CISA guidance for authoritative remediation instructions.