October 23, 2026 is shaping up to be one of those days where the threat landscape shifts on multiple axes simultaneously. Defenders are facing an actively exploited SD-WAN management zero-day, two unpatched Linux kernel RCE flaws disclosed publicly before fixes exist, a China-linked AI-assisted supply chain compromise, a massive cloud hosting breach, and a North Korean threat actor experimenting with post-quantum cryptography in malware delivery. Each of these items demands attention on its own; together, they paint a picture of adversaries probing every layer of enterprise infrastructure with increasingly sophisticated tooling.

The most immediately urgent issue for network and infrastructure teams is the Arista VeloCloud Orchestrator SQL injection zero-day. Arista confirmed on October 22 that this flaw is being actively exploited in the wild against on-premises VCO deployments. The vulnerability allows any authenticated user to perform SQL injection against the orchestrator, which is the central nervous system of a VeloCloud SD-WAN environment. Compromise of the VCO means an attacker can potentially manipulate routing policy, extract credentials, pivot to connected branch sites, and establish persistent access across the entire SD-WAN fabric. Arista has released patches, and applying them immediately must be the top priority for any organization running VCO on-premises. Until patching is complete, restrict VCO management interface access to trusted administrative IP ranges only, enforce multi-factor authentication on all orchestrator accounts, and review VCO access logs for anomalous authenticated sessions or unusual API calls that could indicate exploitation attempts.

For Linux server administrators, two publicly disclosed remote code execution vulnerabilities in KSMBD, the kernel's built-in SMB server, are creating a dangerous window of exposure. Both flaws are rated CVSS 9.0 by Trend Micro's Zero Day Initiative, and one of them, tracked as ZDI-CAN-33774, can reportedly be triggered before authentication completes, making it especially dangerous in any environment where KSMBD is internet-accessible or reachable from untrusted network segments. Critically, no mainline kernel fix exists yet. Organizations should audit immediately whether KSMBD is enabled on any Linux servers and, if it is not required, disable it now. Where SMB file sharing is genuinely needed on Linux, consider switching to Samba as an interim measure until kernel patches are available. Network-level controls blocking SMB ports from untrusted sources are essential, and IDS signatures targeting malformed SMB negotiation packets should be reviewed and tuned.

The ConnectWise supply chain attack attributed to China-linked Storm-0940 introduces a new dimension of concern: the use of ARTEX, an AI agent framework, to automate reconnaissance and lateral movement post-compromise. This is a meaningful escalation. AI-assisted post-exploitation means adversaries can move faster, adapt to defensive responses in near real-time, and cover more ground inside a compromised environment than traditional tooling allows. Any organization using ConnectWise Cloud Backup should verify the integrity of their deployment immediately, apply all available patches, and audit recent backup job activity and administrative account changes for signs of unauthorized access. Broader supply chain hygiene practices apply here: review third-party software update mechanisms, validate code signing on any ConnectWise components, and ensure that backup infrastructure is segmented from production environments.

The Onamae Desktop Cloud breach, affecting up to 27,000 customer VPS instances, is a stark reminder of shared infrastructure risk. Malware deployed at the hypervisor or management plane level can affect tenants who have done nothing wrong individually. If your organization uses Onamae Desktop Cloud or any VPS provider that has not yet confirmed the integrity of its infrastructure, treat those instances as potentially compromised. Rotate all credentials stored on or accessible from those systems, audit outbound network connections for command-and-control indicators, and consider redeploying from clean images on verified infrastructure.

Finally, the Lazarus Group's adoption of post-quantum cryptography in malware delivery chains is a forward-looking threat that deserves strategic attention even if its immediate operational impact is uncertain. By encrypting malware communications with post-quantum algorithms, Lazarus is positioning itself to evade future cryptanalytic defenses and potentially defeat current network inspection tools that rely on decrypting TLS traffic for analysis. Security teams should begin evaluating whether their SSL inspection and EDR tooling vendors have roadmaps for post-quantum algorithm support, and threat intelligence feeds should be updated to include known Lazarus infrastructure indicators associated with this campaign.

Defensive priorities for today:

- Patch Arista VeloCloud Orchestrator immediately and restrict management interface access to trusted IPs
- Disable KSMBD on all Linux servers where it is not required; block SMB from untrusted network segments
- Audit ConnectWise deployments for signs of supply chain compromise and enforce supply chain integrity controls
- Treat Onamae Desktop Cloud VPS instances as potentially compromised; rotate credentials and redeploy from clean images
- Begin assessing post-quantum readiness in your network inspection and endpoint detection tooling
- Elevate threat intelligence monitoring for Storm-0940 and Lazarus Group indicators across all environments

This briefing is informational and does not replace official vendor advisories; consult Arista, the Linux kernel security team, ConnectWise, and your VPS provider directly for authoritative guidance and patch details.