Ransomware Surges, Critical Exploits Mandate Urgent Patching

Critical Vulnerabilities Under Active Exploitation:

• Arista Patches Exploited VeloCloud Orchestrator Zero-Day (CVE-2026-114625): Arista has released patches for a critical zero-day vulnerability in its VeloCloud Orchestrator, now listed on CISA's KEV catalog. This SQL injection flaw, with a CVSS score of 9.9, allows for privilege escalation and has been actively exploited, necessitating immediate patching by federal agencies by October 26.
• PHP2Shell Flaws Actively Exploited, Triggering Global Scramble: CISA has issued a directive for federal agencies to patch PHP2Shell vulnerabilities by October 29, 2026, as millions of services remain vulnerable. Exploitation has been observed, leading to confirmed remote code execution and cookie exfiltration, with slow global patch adoption posing a widespread risk.

New Threats and Advisories:

• Ransomware Attacks Surge 50% in Q3 2026, Fueled by Gang Rivalry: Ransomware attacks saw a 50% increase in Q3 2026, driven by a shift towards data-theft-only extortion models by groups like The Gentlemen and Qilin. This tactic, particularly impacting SMBs and manufacturing in North America, prioritizes reputational damage and intellectual property loss over operational disruption. Detection strategies now focus on DLP, Network Traffic Analysis, and UEBA.
• New Ransomware Group 'Emperador' Claims Attack on AB InBev: A new ransomware group, 'Emperador,' has claimed responsibility for a data breach at Anheuser-Busch InBev, alleging the exfiltration of 3.9 GB of sensitive data, including Azure blob storage assets and PKI certificates. The group is demanding a $1 million ransom, though these claims remain unverified.

Policy & Industry Notes:

• Senator Warren Blasts Financial Regulators' Weaker Cyber Rules: Senator Elizabeth Warren has criticized the Federal Reserve, FDIC, and OCC for recent policy changes that she argues weaken cybersecurity enforcement for banks. She contends that a narrower definition of 'unsafe or unsound' practices creates a high bar for regulatory action, potentially leaving the U.S. banking system vulnerable to AI-enabled threats.
• ODVA's CIP Security Spec for EtherNet/IP Earns IEC 62443 Certification: ODVA's CIP Security specification for EtherNet/IP networks has achieved IEC 62443-4-2 certification at Security Level Capability 3 (SL-C 3). This certification provides a verified security baseline for industrial control systems, expected to simplify the development and certification of secure products for manufacturers and aid compliance with regulations like the EU's Cyber Resilience Act.
• New NERC Rule for Low-Impact Systems Creates Audit & Compliance Risks: The NERC CIP-003-9 standard, effective since April 2026, is presenting compliance challenges for the North American energy sector regarding vendor remote access to low-impact Bulk Electric System (BES) cyber systems. A key concern is the discrepancy between the three-year recordkeeping requirement and NERC's potential six-year audit scope, risking non-compliance penalties for older activities.