VeloCloud zero-day exploited, Railway secrets breach, M365 token replay | Cyber Security News Oct 23

Attackers are exploiting a third VeloCloud Orchestrator zero-day, stolen Microsoft 365 tokens were replayed against 79 organizations from one hosting range, and Railway is telling every customer to rotate their secrets. Plus eMudhra's root leaving Chrome on October 27, and a firewall whose admin password was "password". Every version number in this episode was checked against the vendor's own advisory before it aired. Today's question: How does your team keep audit findings from turning into a pay negotiation? Reply in the comments or at [email protected].

1. Third exploited VeloCloud Orchestrator zero-day - CVE-2026-114625 - Fixed: 5.2.3.18, 6.1.3.10 or 6.4.2.12 - Do: Patch and restrict VeloCloud Orchestrator - https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199

2. Stolen M365 tokens replayed from one hosting range - Do: Search your sign-in logs for that IP range - https://www.huntress.com/blog/token-replay-spray

3. Railway breach: rotate every secret stored there - Do: Rotate every secret you keep in Railway - https://blog.railway.com/p/security-disclosure-wednesday-october-21st

4. Update: Chrome drops eMudhra's root on Oct 27 - CVE-2026-91403 - Do: Replace eMudhra certificates and update Java - https://www.oracle.com/security-alerts/alert-cve-2026-91403.html

5. Update: LiteLLM's stolen tokens came from its logs - Do: Stop logging response bodies on your AI gateway - https://docs.litellm.ai/blog/security-incident-oct-21-2026

6. NoMachine web service open to remote code - CVE-2026-114549 - Fixed: 10.1.7, 9.9.6 or 8.27.1 - Do: Upgrade NoMachine and keep its web port internal - https://www.zerodayinitiative.com/advisories/ZDI-26-786/

7. Splunk fixes 9.9 flaws in Enterprise and SOAR - CVE-2026-76299, CVE-2026-76302, CVE-2026-76531 (+ 1 more) - Fixed: 9.4.16, 10.0.11, 10.2.8 or 10.4.4; SOAR 8.7.0 - Do: Upgrade Splunk Enterprise and SOAR - https://advisory.splunk.com/advisories/SVD-2026-1008

8. Roundcube fixes 20 flaws in 1.6.20 and 1.7.5 - Fixed: 1.6.20 or 1.7.5 - Do: Upgrade Roundcube - https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5

9. Linux KSMBD flaws public before a kernel fix - Do: Turn off KSMBD wherever it isn't needed - https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html

10. Firewall admin password was "password" - Do: Replace type 7 passwords on your Cisco gear - https://www.theregister.com/security/2026/10/22/it-department-and-auditors-at-major-pharmacy-chain-got-into-a-rip-roaring-fight-about-using-password-on-cisco-firewall/5304592