Urgent.News

What's breaking now, across thousands of outlets.

Thursday, 22 October 2026 Reading Room

Tech

Third VeloCloud Orchestrator Flaw Exploited in 2026: CVE-2026-114625 in a Pattern

Third VeloCloud Orchestrator Flaw Exploited in 2026: CVE-2026-114625 in a Pattern CVE-2026-114625 is the third VeloCloud Orchestrator vulnerability that Arista has reported as exploited since late July 2026. The repetition is the story: the same management plane keeps producing critical, network-reachable flaws, and the operational response keeps arriving after exploitation has begun. The…

dev.to ·

Arisota has reported three critical vulnerabilities in VeloCloud Orchestrator since late July 2026, all of which have been exploited. The latest, CVE-2026-114625, is an SQL injection flaw that allows any authenticated user, including low-level customer roles, to escalate to a superuser operator. This marks the third time the same management plane has produced critical flaws with delayed operational responses.

The earlier vulnerabilities CVE-2026-16812 and CVE-2026-93952 were both rated lower on the CVSS scale and did not require authentication. The consistency in advisory language across the three vulnerabilities suggests a stable understanding of the asset, not a stable cause. The fact that orchestrators patched for earlier vulnerabilities remain vulnerable to CVE-2026-114625 indicates patch compounding.

Arista states that hosted and dedicated orchestrators have been patched, but on-premises customers must apply specific fixes themselves. To improve security, organisations should shorten the interval between advisories and build verification, and treat the orchestrator's management interface as internet-exposed by default.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

Playwright Email Tests Need a Cleanup Contract

Email-based end-to-end tests often look flaky for the wrong reason. A signup test creates a user, waits for a verification message, and sometimes finds an email that belongs to a previous run.

  • Email-based fixtures cause flakiness in end-to-end email tests.
  • Implement ownership contract for test mailboxes to improve reliability.
  • Clear contract includes ownership, readability, lifespan, and cleanup responsibilities.

·dev.to

Using Curl

Curl is a command-line utility and underlying library (libcurl) used to transfer data across a wide range of network protocols, including HTTP, HTTPS, FTP, FTPS, SCP, SFTP, LDAP, MQTT, and more.

·dev.to

Using the Linux IP Command to Manage Server Network Interfaces

The ip command is a built-in Linux network management utility that offers a wide range of features and tools for managing network interfaces.

  • ip command consolidates functions of older Linux network tools.
  • Use ip link show to view all network interfaces and their states.
  • Configure IP addresses with ip addr add and manage MTU with ip link set.

·dev.to

Using Rsync to Transfer Files in Linux

Rsync is a file transfer tool for transferring and synchronizing files across systems. It's commonly used for backups, file mirroring, and updating files between local directories or remote servers.

  • Rsync efficiently transfers only file differences between source and destination.
  • Install Rsync using distribution-specific commands (e.g., sudo apt install rsync for Ubuntu/Debian).
  • Use rsync [OPTION] SRC DEST syntax to copy files or directories.

·dev.to

More from Thursday 22 October →