Thursday 22 Oct 2026

Reported exploited, not on CISA's list yet

• CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection VulnerabilityArista VeloCloud Orchestrator · Critical 9.9 · CISA: check for compromise · Federal deadline 2026-10-26 · Fixed in 5.2.3.18 · Zero-day reported by 5 outlets, first by Bluesky: exploited in the wild

Supply chain compromises

• Malicious release acousticpack 0.1.0 on PyPI was a malicious releaseacousticpack 0.1.0
• Malicious release hookgantry 0.1.0 on PyPI was a malicious releasehookgantry 0.1.0
• Malicious release pipegrip 0.1.0 on PyPI was a malicious releasepipegrip 0.1.0
• Malicious release acoustichub 0.1.0 on PyPI was a malicious releaseacoustichub 0.1.0
• Malicious release asrdock 0.1.0 on PyPI was a malicious releaseasrdock 0.1.0
• Malicious release asrloom 0.1.0 on PyPI was a malicious releaseasrloom 0.1.0
• Malicious release audiokit 0.1.0 on PyPI was a malicious releaseaudiokit 0.1.0
• Malicious release benchbridge 0.1.0 on PyPI was a malicious releasebenchbridge 0.1.0
• Malicious release benchworks 0.1.0 on PyPI was a malicious releasebenchworks 0.1.0
• Malicious release evalstream 0.1.0 on PyPI was a malicious releaseevalstream 0.1.0
• Malicious release modelworks 0.1.0 on PyPI was a malicious releasemodelworks 0.1.0
• Malicious release phonemeforge 0.1.0 on PyPI was a malicious releasephonemeforge 0.1.0
• Malicious release phonemeprobe 0.1.0 on PyPI was a malicious releasephonemeprobe 0.1.0
• Malicious release soundsocket 0.1.0 on PyPI was a malicious releasesoundsocket 0.1.0
• Malicious release speakbench 0.1.0 on PyPI was a malicious releasespeakbench 0.1.0
• Malicious release speaksocket 0.1.0 on PyPI was a malicious releasespeaksocket 0.1.0
• Malicious release speechprobe 0.1.0 on PyPI was a malicious releasespeechprobe 0.1.0
• Malicious release ttsdock 0.1.0 on PyPI was a malicious releasettsdock 0.1.0
• Malicious release ttsflow 0.1.0 on PyPI was a malicious releasettsflow 0.1.0
• Malicious release ttsprobe 0.1.0 on PyPI was a malicious releasettsprobe 0.1.0
• Malicious release ttsweaver 0.1.0 on PyPI was a malicious releasettsweaver 0.1.0
• Malicious release vocabbench 0.1.0 on PyPI was a malicious releasevocabbench 0.1.0
• Malicious release vocabblend 0.1.0 on PyPI was a malicious releasevocabblend 0.1.0
• Malicious release voicekit 0.1.0 on PyPI was a malicious releasevoicekit 0.1.0
• Malicious release voxweaver 0.1.0 on PyPI was a malicious releasevoxweaver 0.1.0
• Malicious release @conduitops/logview-archive 1.0.1 on npm was a malicious release@conduitops/logview-archive 1.0.1
• Malicious release formatting-subtitles 1.0.2 on npm was a malicious releaseformatting-subtitles 1.0.2
• Malicious release log-rotate-testmetest 1.0.1 on npm was a malicious releaselog-rotate-testmetest 1.0.1
• Malicious release net-codec-testmetest 1.0.1 on npm was a malicious releasenet-codec-testmetest 1.0.1
• Malicious release simplewave 0.0.2 on npm was a malicious releasesimplewave 0.0.2
• Malicious release 1h1 1.0.0 on PyPI was a malicious release1h1 1.0.0
• Malicious release aanthropic 1.0.0 on PyPI was a malicious releaseaanthropic 1.0.0
• Malicious release @liauto/darwin-x64 0.1.1-b3 on npm was a malicious release@liauto/darwin-x64 0.1.1-b3
• Malicious release @pkgship/frpc-darwin-amd64 0.71.1 on npm was a malicious release@pkgship/frpc-darwin-amd64 0.71.1
• Malicious release agentic-awesome-skills 19.0.0, 19.9.0, 19.6.0 on npm was a malicious releaseagentic-awesome-skills 19.0.0, 19.9.0, 19.6.0, 18.12.0, 18.9.0, 18.11.0, 19.4.0, 19.10.1, 18.14.0, 18.13.0, 19.0.1, 18.10.0, 19.2.0, 19.7.0, 19.1.0, 19.3.0, 19.5.0, 19.12.1, 19.13.0, 19.12.0
• Malicious release @lumen-labs-dev/whisper-node 0.5.1 on npm was a malicious release@lumen-labs-dev/whisper-node 0.5.1
• Malicious release darknode-cli 2.46.2, 2.46.1, 2.46.0 on npm was a malicious releasedarknode-cli 2.46.2, 2.46.1, 2.46.0
• Malicious release x402-prompt-injection-scan 0.1.4 on npm was a malicious releasex402-prompt-injection-scan 0.1.4
• Malicious release @pkgship/frpc-linux-amd64 0.71.1 on npm was a malicious release@pkgship/frpc-linux-amd64 0.71.1
• Malicious release @pkgship/frps-linux-amd64 0.71.1 on npm was a malicious release@pkgship/frps-linux-amd64 0.71.1
• Malicious release @seggy116/next-diff 0.3.0 on npm was a malicious release@seggy116/next-diff 0.3.0
• Malicious release journey-teste-shellhello 0.2.0 on PyPI was a malicious releasejourney-teste-shellhello 0.2.0
• Malicious release @factiii/runner 0.28.0 on npm was a malicious release@factiii/runner 0.28.0

Critical flaws in products attackers have targeted

• CVE-2026-110264 Integer Overflow or Wraparound in GitLabGitLab GitLab · Critical 10 · Fixed in 18.11.13
• CVE-2026-114612 LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt KeyBerriAI litellm · Critical 9.9 · Fixed in 1.100.4

10-2410-2310-2210-2110-2010-1910-1810-1710-1610-1510-1410-1310-1210-11Atom feedJSON