CISA says attackers are already exploiting serious flaws in Collabora Online and Arista VeloCloud Orchestrator, so any business using either should check for fixes.
The U.S. cybersecurity agency CISA says hackers are actively attacking two business tools: the built-in server in Collabora Online and Arista VeloCloud Orchestrator. On Friday, CISA added one critical flaw in each to its Known Exploited Vulnerabilities list. That list names security holes that criminals are already using in real attacks.
In the Collabora case, attackers have been seen using the flaw to plant a web shell on Nextcloud servers. A web shell is a hidden backdoor that lets someone control a server from afar. Once inside, they look around for stored credentials, password manager files and cryptocurrency wallets.
The Arista flaw works differently. An attacker needs network access to the VeloCloud web portal and a valid logged-in session. Even the lowest listed role, Enterprise Read Only, is enough. This is the third flaw in the same product used in attacks since July 2026. The two earlier ones each scored 10.0 on a 10-point severity scale.
Arista confirmed the flaw is known to be actively exploited. It has not said who is behind the attacks, how they work, what attackers did afterward or how many organizations were hit. It did share two IP addresses, located in Japan, tied to the activity.
Companies that use neither tool can relax. Everyone else should work through the steps in the alert box above. Federal agencies have been told to apply the fixes by October 26, 2026, and private businesses are wise to treat that date as their own deadline.
If your business runs Collabora Online or Arista VeloCloud Orchestrator, install the vendor fixes now, because attackers are already using these flaws.
A viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youDARPA wants AI to hunt for design flaws in stock, bond, energy and cloud markets, so enemies cannot use them to cause economic damage that reaches households.
Read more: Pentagon wants AI to find weak spots in stock and energy marketsTuring Award winner Richard Sutton says more computing power alone will not make AI truly smart. Big AI companies disagree, which matters for anyone betting on AI.
Read more: AI pioneer says piling on computing power won't make machines smart
