Heads up for anyone running on-prem VeloCloud Orchestrator. CVE-2026-114625 (CVSS 9.9) lets an authenticated user with only Enterprise Read Only portal access escalate to local superuser on the VCO host. Arista reports active exploitation.

What’s known so far:

→ Only on-prem VCO deployments are affected
→ The attacker needs only the lowest-privilege portal role
→ Arista observed attack traffic from 74.82.197[.]86 and 38.54.50[.]151

What to do:

→ Upgrade to the fixed VCO release for your branch
→ Search your logs for those 2 IPs and for unusual activity from read-only accounts, such as logins at odd hours or from new sources
→ Audit who holds portal accounts, including stale and shared logins. A read-only account usually gets little scrutiny, and that’s exactly the access this attack needs.

One bug, with three names (because of course it does) - Node2Shell, HTTP2Shell, and Broccoli2Shell... Anyway,

• A public checker (node2shell-check/1.0, out of AS44620 / Turkey) is already hitting sensors cataloguing which hosts decompress Brotli at all.
• Unlike PHP2Shell earlier this week - working RCE chain exists. ELLIO reproduced RCE in the lab against Node 24.22.0 on x86-64 - four targets (plain node:http, the official slim image as root, Express 5.3.0, Koa 3), official binaries, ASLR on, each returning a shell.
• Official Node builds are non-PIE, so the offset is a per-build constant. Pin it once for a popular version, reuse it against every host on that version.

// Here we go again meme goes here.