Morning Threat Brief: VeloCloud zero-day turns read-only logins into superusers, Signal calls that never hang up

Morning. Today's theme is trust in the wrong place: a read-only login that owns the network, and a hang-up button that is only a suggestion.

Arista VeloCloud zero-day: read-only in, superuser out

Arista disclosed CVE-2026-114625 on October 22, a critical SQL injection (CVSS 9.9) in VeloCloud Orchestrator On-Prem that is already being exploited. An authenticated user with the lowest built-in role, Enterprise Read Only, can escalate to operator privileges and impersonate a superuser, so the blast radius is the whole SD-WAN fabric, not one tenant. This is the third exploited VCO zero-day in four months.

What to do: patch on-prem VCO to 5.2.3.18, 6.1.3.10, or 6.4.2.12. Until then, restrict the web interface to trusted admin networks and block the two observed attacker IPs, 74.82.197.86 and 38.54.50.151.

Signal calls that never hang up

A critical flaw in RingRTC, Signal's calling library (CVE-2026-113380, CVSS 9.3), lets a malicious caller flood the call's event queue so your hang-up request never gets processed. Your screen says the call ended while audio, possibly video, keeps streaming to the other party. Details and a conceptual proof of concept went public October 20. The attacker must be a participant on the call.

What to do: update Signal everywhere. The fix is RingRTC 2.72.0.

BRONZE SANDCASTLE: sideloading through signed apps

Sophos named a previously undocumented China-aligned cluster active since mid-2025, targeting organizations in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Its signature move is DLL sideloading through legitimate signed applications, most distinctively a malicious sbiedll.dll placed next to the real Sandboxie executable, with the backdoor encrypted on disk and decrypted in memory at runtime. The payload enumerates networks and accounts, captures keystrokes and screenshots, and operators have copied the Active Directory ntds.dit database.

What to hunt: signed executables loading adjacent DLLs, config.ini reads followed by in-memory execution, anomalous vssadmin.exe use. Campaign indicators are in the IoC Library.

Cisco October bundle: 34 fixes, one critical RCE

Cisco patched 34 vulnerabilities across Expressway Series, IOS XR, Snort 3, and Unified Communications. The worst is CVE-2026-76466, a critical RCE in Expressway that runs commands as root. Cisco reports no exploitation in the wild, so this is a maintenance-window story: Expressway X15.5.20, Snort 3 3.12.4.0, and the rest in your next window.

Fresh in the IoC Library: the BRONZE SANDCASTLE sideloading chain and C2 indicators, plus the two Arista attacker IPs.

Full entries with huntable indicators: kevinthecyberguy.com/vuln-watch and kevinthecyberguy.com/ioc-library

← kevintswaney.com