# Threat Intel Brief — October 25, 2026

TL;DR

  • Active exploitation confirmed for two critical vulnerabilities: Collabora Online (CVE-2026-110447) and Arista VeloCloud Orchestrator (CVE-2026-114625), both added to CISA's KEV catalog with federal remediation deadline October 26.
  • Supply chain compromise of LiteLLM Python package via leaked master key enabled threat actor to publish malicious version 1.107.0, exfiltrating GitHub tokens and API credentials from downstream users.
  • Memory corruption flaw in Google Brotli decoder (CVE-2026-111497) affects Node.js, Bun, Python packages, and Envoy proxies, enabling potential remote code execution via crafted compressed data.
  • UEFI bootkit "BlackX" deployed against Central Asian diplomatic agencies exploits CVE-2022-21894 to bypass Secure Boot, attributed with medium confidence to APT41.
  • Abandoned software risk highlighted by Dutch firm's intervention to disable vulnerable updater in Time4Popcorn (CVE-2026-30612), affecting millions of endpoints globally.

---

Critical Threats

LiteLLM Supply Chain Attack via Leaked Master Key

What happened:
A threat actor exploited a LiteLLM master key accidentally published to a public GitHub repository in May 2026 to compromise the project's release pipeline. Operating from IP 69.48.229[.]143, the attacker used the unrevoked key to extract GitHub OAuth tokens, deploy malicious workflows designed to harvest credentials, and publish a compromised version (1.107.0) of the popular Python LLM gateway package on October 21, 2026. The malicious release was pushed from a lookalike repository and remained available on PyPI and Docker Hub for 37 minutes before quarantine. Malicious workflows targeted API keys for Anthropic, OpenAI, AWS Bedrock, Together AI, Tavily, GitGuardian, database credentials, and GitHub tokens, exfiltrating data to attacker-controlled endpoints.

Impact:
Organizations that installed LiteLLM version 1.107.0 between 11:46 a.m. and 1:23 p.m. UTC on October 21 face immediate risk of credential theft, unauthorized access to LLM inference services, and potential lateral movement into cloud infrastructure. The compromise demonstrates systemic risk in AI/ML tooling supply chains and the consequences of inadequate key rotation following credential exposure. LiteLLM has revoked all internal tokens; downstream users must assume compromise if the malicious version was deployed.

Recommendations:

  • Audit all systems for LiteLLM v1.107.0 installation (check pip freeze, requirements.txt, Docker images with tags v1.107.0, latest, main-latest, main-stable pulled during the exposure window). Uninstall immediately and replace with verified clean version.
  • Rotate all API keys and tokens accessible to systems running LiteLLM v1.107.0, including credentials for Anthropic, OpenAI, AWS Bedrock, Together AI, Tavily, GitGuardian, and any LLM provider credentials stored in environment variables or configuration files.
  • Review network logs for outbound connections to webhook[.]site domains from October 21-24, 2026. Investigate any hits for data exfiltration scope.
  • Inspect GitHub Actions workflow logs for unauthorized .github/workflows/cache.yml additions or ci-tmp-* branch activity between October 10-21, 2026.
  • Implement supply chain verification controls: pin dependencies to known-good hashes, enable PyPI two-factor authentication, and monitor repository source changes in CI/CD pipelines.

---

Collabora Online and Arista VeloCloud Under Active Exploitation

What happened:
CISA added CVE-2026-110447 (Collabora Online Built-in CODE Server) and CVE-2026-114625 (Arista VeloCloud Orchestrator) to its Known Exploited Vulnerabilities catalog on October 23, 2026, citing confirmed active exploitation. Threat actors are deploying web shells on Nextcloud servers running vulnerable Collabora CODE instances to conduct reconnaissance, credential theft, and cryptocurrency wallet searches. Separately, attackers are exploiting an SQL injection flaw in Arista VeloCloud Orchestrator to escalate privileges from low-privilege authenticated accounts. Attack traffic has been observed from IPs 74.82.197.86 and 38.54.50.151. This marks the third actively exploited VeloCloud vulnerability since July 2026.

Impact:
CVE-2026-110447 enables remote code execution via OS command injection, leading to full server compromise, credential theft, and lateral movement in Nextcloud deployments. CVE-2026-114625 allows authenticated users with Enterprise Read Only role or higher to access privileged VCO functionality via SQL injection, enabling privilege escalation. Federal Civilian Executive Branch agencies must remediate by October 26, 2026. Organizations using Nextcloud with Collabora or Arista VeloCloud face immediate risk of data exfiltration, ransomware deployment, and persistent access.

Recommendations:

  • Immediately upgrade Collabora Online Built-in CODE Server to version 26.4.303 or later on all Nextcloud instances.
  • Upgrade Arista VeloCloud Orchestrator to version 5.2.3.18, 6.1.3.10, or 6.4.2.12 depending on your branch.
  • Block inbound traffic from IPs 74.82.197.86 and 38.54.50.151 at perimeter firewalls and inspect logs for connections from these sources.
  • Audit Nextcloud servers for web shells and review authentication logs for unauthorized VCO access by Enterprise Read Only or higher accounts.
  • Restrict network access to VCO web interface to trusted IP ranges only.
  • Search for indicators of credential theft, password manager access, and cryptocurrency wallet enumeration on affected Nextcloud systems.

---

Brotli Decoder Memory Corruption Enables RCE Across Multiple Platforms

What happened:
A memory corruption vulnerability (CVE-2026-111497) in Google's Brotli C library affects Node.js, Bun, Python packages (brotli and brotlicffi), Envoy proxies, and Istio service meshes. The flaw allows crafted Brotli-compressed data to overwrite past the end of a buffer and corrupt program memory, potentially enabling remote code execution. Proof-of-concept RCE has been demonstrated on Node.js ARM64 Linux, though no in-the-wild exploitation has been reported as of October 23, 2026. The vulnerability is triggered when applications decode untrusted Brotli-compressed data, including HTTP responses with Content-Encoding: br or compressed request bodies.

Impact:
Attackers can exploit crafted Brotli payloads to corrupt memory and potentially execute arbitrary code on vulnerable servers (via malicious client uploads) or clients (via malicious server responses). Node.js and Bun runtimes are exposed through fetch() of br-encoded responses and Express/body-parser request handling. Python applications are at risk if brotli or brotlicffi packages are installed, even without explicit import, as HTTP clients auto-decode br responses. Envoy/Istio proxies are affected only if Brotli decompression is explicitly enabled. Google rates the vulnerability as 9.2 critical (CVSS 4.0); Node.js and Red Hat rate it 8.1 high. Each product ships its own Brotli decoder copy, requiring individual patching.

Recommendations:

  • Update immediately: Node.js to 22.23.4/24.22.1/26.12.1; Bun to 1.4.4; Envoy to 1.40.0/1.39.3/1.38.6/1.37.8/1.36.12; Istio to 1.31.2/1.30.6/1.29.9; Python brotli to 1.2.1 and brotlicffi to 1.2.1.0; cdxgen to 13.5.0/12.8.9. Restart all services and rebuild container images after patching.
  • For Python environments, run pip uninstall brotli brotlicffi if immediate patching is not feasible, forcing HTTP clients to fall back to gzip/deflate.
  • Configure web application firewalls and reverse proxies to reject incoming requests with Content-Encoding: br header until patching is complete.
  • Disable automatic Brotli decompression in HTTP client libraries where configurable, and reject br-encoded responses before decoding.
  • Audit Envoy and Istio configurations to verify if Brotli decompression filters are enabled; disable if not operationally required until patched.

---

Threat Actor Activity

BlackX UEFI Bootkit Targets Central Asian Diplomatic Agencies

A new UEFI bootkit malware family designated "BlackX" has been deployed in an espionage campaign targeting diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan during early 2026. The bootkit exploits CVE-2022-21894 (Baton Drop) to bypass Secure Boot protections and load a malicious Windows kernel driver signed with a revoked certificate. The driver disables security callbacks, tampers with Event Tracing for Windows providers, and specifically targets Kaspersky and Avast security products. Follow-on payloads include a RAT using cloud services (Google Drive, OneDrive, Yandex.Disk) for command-and-control communications and OxiDLLRunner, which uses DLL side-loading and OLLVM obfuscation to execute Rust-based plugins.

Analysis reveals that BlackX contains code segments present in BlackLotus samples but absent from the publicly leaked BlackLotus repository, suggesting the operators had access to complete source code or performed sophisticated reverse engineering. The campaign has been attributed with medium confidence to APT41 (also tracked as Brass Typhoon, Wicked Panda, and Barium), a Chinese state-sponsored threat group. All identified victims were running fully patched Windows systems, indicating the threat actor specifically selected targets where administrators had not manually activated additional Secure Boot revocations—a gap in the standard patching process that requires manual intervention beyond automatic updates.

Defensive priorities:

  • Manually activate Secure Boot revocations for CVE-2022-21894 following Microsoft's guidance, as automatic patching does not trigger certificate revocation—add 'Windows Production PCA 2011' certificate to blocklist even after its October 19, 2026 expiration.
  • Monitor for unauthorized MOK (Machine Owner Key) enrollment and changes to UEFI/EFI boot configuration using firmware integrity monitoring solutions.
  • Detect kernel driver loading with revoked or suspicious certificates via Windows Code Integrity logs and driver signature verification.
  • Implement ETW tampering detection by monitoring for modifications to Event Tracing for Windows providers and security callback disablement using Sysmon Event ID 22 and kernel callback enumeration.
  • Monitor cloud storage services (Google Drive, OneDrive, Yandex.Disk) for C2 communications via network traffic analysis and restrict unauthorized cloud service usage at the network perimeter.

---

Geopolitical Context

Private Sector Intervention in Abandoned Software Infrastructure

Dutch security firm Eye Security deployed over 2 million updates between November 2025 and March 2026 to disable a vulnerable background updater in Time4Popcorn, an abandoned Popcorn Time fork. The updater (CVE-2026-30612, CVSS 9.8) ran with SYSTEM/root privileges and accepted unsigned updates over unencrypted HTTP from abandoned domains, posing a botnet risk to an estimated 2.5-3 million Windows systems and 250,000-350,000 Macs globally, including machines on government, military, and corporate networks.

The operation illustrates growing tension between proactive cyber defense and traditional notions of system sovereignty. Eye Security's unilateral intervention—pushing updates to millions of machines globally without owner consent—represents an emerging gray area in cyber operations. While the firm acted to prevent potential botnet formation, the operation raises questions about the legitimacy of "defensive" intrusions by private actors, particularly when affecting government and military networks across multiple jurisdictions. The firm consulted legal advisors before proceeding and later transferred control of the domains to the Shadowserver Foundation, a U.S.-based nonprofit with established relationships to law enforcement and CISA.

No active exploitation of the vulnerability has been observed, and Eye Security found no evidence anyone else was serving malicious code through the abandoned update domains. CISA assigned the vulnerability a severity rating of 9.8/10 but had not added it to its Known Exploited Vulnerabilities catalog as of October 2026.

---

Recommended Actions

Immediate (0-24 hours)

  • Audit all systems for LiteLLM v1.107.0 and uninstall immediately; rotate all API keys and tokens accessible to affected systems.
  • Upgrade Collabora Online Built-in CODE Server to version 26.4.303 or later on all Nextcloud instances.
  • Upgrade Arista VeloCloud Orchestrator to patched versions (5.2.3.18, 6.1.3.10, or 6.4.2.12).
  • Block IPs 74.82.197.86 and 38.54.50.151 at perimeter firewalls and inspect logs for connections from these sources.

Short-term (24-72 hours)

  • Update Node.js, Bun, Python brotli packages, Envoy, and Istio to patched versions addressing CVE-2026-111497.
  • Configure web application firewalls to reject incoming requests with Content-Encoding: br header until Brotli patching is complete.
  • Review network logs for outbound connections to webhook[.]site domains from October 21-24, 2026.
  • Audit Nextcloud servers for web shells and review VCO authentication logs for unauthorized access.

This week

  • Manually activate Secure Boot revocations for CVE-2022-21894 following Microsoft's guidance.
  • Scan enterprise endpoints for Time4Popcorn/Popcorn Time installations and uninstall immediately.
  • Implement supply chain verification controls: pin dependencies to known-good hashes, enable two-factor authentication for package management.
  • Monitor for unauthorized MOK enrollment and changes to UEFI/EFI boot configuration.

---

Watch List

  • Arista VeloCloud Orchestrator: Third actively exploited vulnerability since July 2026 suggests sustained adversary interest in SD-WAN infrastructure. Monitor for additional disclosures and exploitation attempts.
  • AI/ML supply chain: LiteLLM compromise highlights risk in LLM gateway and inference tooling. Expect increased targeting of AI development dependencies.
  • UEFI bootkit evolution: BlackX demonstrates continued exploitation of CVE-2022-21894 despite patches. Manual Secure Boot revocation remains critical gap in enterprise patching processes.
  • Abandoned software infrastructure: Time4Popcorn incident highlights systemic risk from orphaned update mechanisms. Monitor for similar interventions by private actors and potential regulatory responses.

---

Sources

  • BleepingComputer: BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot — https://www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-boot/
  • The Hacker News: Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software — https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html
  • The Hacker News: Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline — https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html
  • The Hacker News: Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet — https://thehackernews.com/2026/10/researchers-push-over-2-million-updates.html
  • The Hacker News: CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud — https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html