Daily brief: Saturday 24 October 2026

Attackers are exploiting a new Arista VeloCloud Orchestrator zero-day, Huntress lays out a Microsoft 365 token-replay campaign across 79 organisations, a maritime IT supplier is the likely way into 40+ shipping firms, GoDaddy has revoked over 400,000 certificates, and GitHub is switching on a default policy for new Copilot features.

Cybersecurity

Arista VeloCloud Orchestrator zero-day is being exploited

Arista says attackers are exploiting CVE-2026-114625, a SQL injection flaw in on-premises VeloCloud Orchestrator, and CISA added it to its Known Exploited Vulnerabilities catalogue on 23 October. It is rated CVSS 9.9 and needs only the lowest built-in tenant role, Enterprise Read Only. Fixed versions are 5.2.3.18, 6.1.3.10 and 6.4.2.12 or later in each release train. Hosted orchestrators have already been patched by Arista, and VeloCloud Gateways and Edges are not affected.

Why it matters for IT: If you run an on-premises orchestrator, upgrade within the same release train now and limit the web interface to admin networks until you do. Arista published two attacker IP addresses, 74.82.197.86 and 38.54.50.151, so block them and search your logs for them.

Source: Windows Forum

Microsoft

Stolen Microsoft 365 sessions used to break into 79 organisations

Huntress says attackers stole Microsoft 365 sign-in sessions through adversary-in-the-middle phishing, device-code phishing and social engineering, then replayed the tokens instead of guessing passwords. Between 14 July and 22 September it saw at least 497 successful sign-ins at 79 organisations. Replay traffic came from addresses in 193.26.115.0/24 at a German hosting firm. In 19 organisations the attackers wiped the user's MFA methods and added their own within three hours, which survives a password reset.

Why it matters for IT: A password reset alone won't fix this: revoke sessions, then remove any new MFA methods, rogue Entra devices named DESKTOP- plus eight characters, and odd inbox rules such as "." or "sss". Restrict device-code flow with Conditional Access if you don't need it.

Source: Huntress

Cybersecurity

Ransomware group got into 40+ shipping firms through an IT supplier

Risky Business reports that the n0n ransomware and extortion group has listed more than 40 port authorities, maritime and shipping companies across 18 countries. Security firm CyDome says the South Korean maritime IT provider CyberLogitec is the likely way in, as half the latest victims are known customers and its website has been down for weeks. The group demanded $1.2 billion in total, and most victims refused to pay and had their data leaked.

Why it matters for IT: This is the supplier problem again: one trusted IT provider with access to many customers. Review which suppliers have standing remote access to your systems, and make sure that access is limited, logged and protected with MFA.

Source: Risky Business

Networking

GoDaddy revokes 404,607 TLS certificates

GoDaddy revoked 404,607 certificates issued under its GoDaddy and Starfield authorities after a third party found they didn't match Starfield's published certificate policy. Most were domain-validated certificates, with 8,552 OV and EV certificates also affected. GoDaddy missed the 18 October deadline and confirmed every affected certificate was revoked by 21 October. Sites still using a revoked certificate may show browser warnings or fail to load.

Why it matters for IT: If any of your sites, mail servers or appliances use GoDaddy or Starfield certificates, check the account for certificates flagged for replacement. Downloading the new certificate isn't enough: install it on the server and test the site.

Source: Hackread

GitHub sets a default policy for new Copilot features

GitHub says Copilot Business and Enterprise organisations will get a global default for generally available Copilot features and client capabilities that admins haven't configured, including MCP servers in Copilot. The default can be Enabled, Disabled or Let organisations decide. Enforcement is rolling out gradually until 26 October. Settings you've already made are kept, and preview features stay opt-in.

Why it matters for IT: If you manage Copilot for developers, check AI Controls, then Copilot, then Default policy for new features, so new features don't switch on without a decision. Set MCP servers explicitly if you want to control which tools Copilot can call.

Source: GitHub Changelog

Weather

Live forecast

Loading the forecast…

Fact of the day

All facts

← All daily briefs