Confidential · 25 Oct 2026
🛡️ Daily Cybersecurity Briefing — 2026-10-25 (Sunday)¶
Window: last 24–48h (M&A and case sweeps extended to 72h, Oct 22–25). Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.
Threat level GUARDEDVictims L30D 117Top actor QilinM&A L30D $58M
Number of the day9.9the CVSS score for CVE-2026-114625, an Arista VeloCloud Orchestrator SQL-injection flaw CISA added to its KEV catalog as actively exploited (Oct 23); any authenticated portal account, including a read-only one, can escalate to superuser. Federal agencies must remediate by Oct 26. CISA
💼 M&A ACTIVITY¶
No new cybersecurity M&A announced in this window (Oct 22–25).MediumM&A sweep (F-23): all six query families run — press wires, open deal-verb searches, cyber trade press, channel/MSSP press, SEC/regional filings, and ~26 tracked private-equity newsrooms (buy- and sell-side wording). 0 new deals found in-window; the search index shows a lag for the most recent days (SecurityWeek's October roundup not yet published). One borderline item was checked and excluded: Maximus/Agile Defense ($660M, announced Oct 19 — three days before this window, and a federal IT/defense-services contractor rather than a pure-play cyber buyer).
L30D summary (Sep 25 – Oct 25): 16 tracked deals, roughly $9.3B in disclosed value. Biggest: Proofpoint/Varonis ($6.3B all-cash), IonQ/Elisity (up to $1.3B all-stock), Bold Eagle Acquisition Corp./REDLattice ($1.25B pre-money SPAC listing plus $335M PIPE). Consolidation theme unchanged: an identity/AI-security thread runs through the window (Vista/HID PKI, Workday/C1.ai, Anthropic/Opaque Systems, IonQ/Elisity, Cohere/AISLE), alongside services/MSP roll-ups (TRG/Fentron, Epiq/Canopy, SGS/Prescient Security) and a PQC/insurtech crossover (SAIC/Information Security Corp, EC-Council/Cyber Insurance Academy).
⚠️ CRITICAL BREACHES & INCIDENTS¶
City of Columbia, South Carolina confirms ransomware attack; core public-safety services unaffected.HighGovernment & Public SectorThe city manager confirmed ransomware Oct 20 after IT staff flagged suspicious activity; the SC Law Enforcement Division is investigating. Affected: the MyColaSC app, GIS/mapping tools, parks & rec reservations, and Animal Services online payments. Police, fire, 911 dispatch, Columbia Water and general bill-pay are unaffected. No data-exposure scope confirmed yet; no group has claimed responsibility. WACH Fox57 · WIS-TV
Richmond Public Schools (Virginia) remains offline district-wide after a cybersecurity incident, ransomware status unconfirmed.HighEducationAll 53 campuses lost internet access Oct 21, disrupting phones, email, Wi-Fi, cameras and the PowerSchool portal; outside cybersecurity experts are assisting restoration. The district has not confirmed encryption, data exfiltration, or a ransomware attribution. A Cybernews report of ransom notes appearing on staff laptops with a 72-hour leak deadline is unverified — no group has claimed responsibility and the district has not confirmed it. WRIC-TV · Hoodline
🔓 CRITICAL VULNERABILITIES¶
CISA adds an Arista VeloCloud Orchestrator SQL-injection flaw to its KEV catalog — CVSS 9.9, actively exploited.CriticalCVE-2026-114625 lets any authenticated portal user, including a read-only account, escalate to local "superuser operator" privileges; Arista's own advisory names two source IPs tied to observed exploitation. Affects on-prem VCO releases before 5.2.3.18 / 6.1.3.10 / 6.4.2.12 (Arista-hosted/dedicated instances already patched). Federal remediation deadline Oct 26. The Hacker News · CISA
A second same-day KEV addition: Collabora Online's built-in CODE server for Nextcloud, CVSS 9.2, OS command injection.CriticalCVE-2026-110447 is triggerable via the app's proxy.php during the brief window the local CODE server is stopped (container restart/upgrade/crash); admins have reported web shells on Nextcloud servers since Sep 10, with the exploitation window spanning Sep–Oct 2026 and the total compromised-server count unknown. Affects versions before 26.4.303. Federal remediation deadline Oct 26. CISA · SecurityAffairs
Developing: PHP's "php2shell" flaws (CVE-2026-109618/109619, CVSS 9.2) show early signs of in-the-wild exploitation, not yet KEV-listed.HighPHP shipped emergency patches Oct 15–16; Huntress saw no exploitation in partner environments as of Oct 20, but watchTowr reported honeypot exploitation attempts and Cloudflare "early attacks" by Oct 21, with Aikido and Patchstack separately claiming confirmed incidents without published technical detail. Worth a same-day follow-up rather than treating as settled. SecurityWeek
🚨 INTELLIGENCE AGENCY ALERTS & POLICY¶
No new CISA/FBI/NSA/NCSC-class advisory beyond the two KEV catalog additions already covered above.MediumChecked CISA advisories/ICS advisories, NCSC-UK, ACSC, the Canadian Centre for Cyber Security and OFAC cyber-sanctions actions (most recent OFAC cyber action remains July 13, 2026); nothing newer found for this window.
🌐 THREAT ACTOR & CAMPAIGN ACTIVITY¶
Scattered ransomware DLS claims dated Oct 24 — Qilin (3 named claims), an unusually large same-day cluster from the smaller Krybit brand (6 victims), and single claims from Deadlock, Lamashtu and Emperador — could not be independently corroborated with a company statement or press coverage in this run.MediumTreat all as unverified leak-site listings, not confirmed breaches; Qilin and The Gentlemen remain the two most-active ransomware brands by recent monthly/quarterly tracking.
Ongoing attacks — follow-up sweep (F-24):Mediumfour cases checked this run. Poole Group/LockBit — publication deadline fell today (Oct 25); no source found reports the clock resolving (leak, delisting or payment) as of this check, though the Sunshine Coast, Australia accounting/advisory firm (not dental as earlier assumed) has confirmed detection, containment and notification to OAIC/ACSC/ATO without confirming the LockBit attribution. MoneyGram/The Gentlemen — 11th check, no leak, sale or payment observed; a widely-cited "42,454 accounts" figure traces only to infostealer-log monitoring, not a published ransomware leak, and remains uncorroborated. Quikrete/Helix — broader DLS-aggregator cross-corroboration found this check, but all trace to the same single underlying leak-site post with no independent press or company confirmation; still a single-claim case. MLD Mortgage (The Money Store)/Storm — no new law firm or cost figure beyond Oct 24's entry; a dating inconsistency in one tracker's timeline (notice mailed Oct 15, after the Oct 9 class-action filings) is flagged for a docket check, not treated as a new development.
No new authoritative APT/nation-state attribution (CISA/FBI/Mandiant/CrowdStrike-class) dated in this window.Medium
🌍 GEOPOLITICS¶
Analyst lens: how this week's cyber activity maps to state strategy. Defense · cyber · economics.
Taiwan's National Security Bureau put a hard number on China's pre-election pressure campaign for the first time: 2.5M+ disputed content items, up roughly 48% year-to-date.HighThe NSB briefed parliament Oct 21 that China-originated disputed/false content aimed at Taiwan's Nov 28 local elections has grown to 2.5 million-plus items in the first nine months of 2026, concentrated on energy, food security, defense policy and specific candidates' platforms, with Chinese-government-linked attacks on Taiwanese networks averaging in the millions per day; officials say AI is now used to profile candidates and shape the influence operations. So what: this is the first officially quantified benchmark (not just a qualitative warning) for a pressure campaign five weeks from the vote — any portfolio company with Taiwan exposure now has a number to put in a board-level risk briefing, not just a direction of travel. The Record · TechRadar
No other new geopolitical-cyber development found this windowMediumdespite extensive searching of CISA, OFAC, EU Council, NATO, Reuters/AP/Bloomberg, The Record, CSIS, Atlantic Council Cyber Statecraft and Lawfare coverage dated Oct 23–25 — this week's NATO undeclared-retaliation doctrine and China travel-advisory wrongful-detention marker both stand as covered in Saturday's briefing, with no material escalation found beyond what's already on file.
Travel advisories: Venezuela, Russia, Ukraine, China and Taiwan checked against Five Eyes source coverage. Venezuela remains unresolved for a second run: two low-quality aggregator sources (thetraveler.org) disagree with each other on the scope of a claimed mid-October FCDO widening — one describes a red/orange split, the other a blanket "do not travel" — and neither is corroborated by a wire service; the official gov.uk change-history mirror could not be reached at all this run (vs. showing "nothing past Sep 2" yesterday), so no write was made and this needs a direct check from a session with gov.uk access. Russia, Ukraine, China and Taiwan unchanged (Level 4/Do Not Travel, Level 4/Do Not Travel, Level 2/Exercise Increased Caution with the Oct 19 wrongful-detention marker, and Level 1/Exercise Normal Precautions respectively).
M&A activity
Alchemy Technology Group → Freeit Data Solutions—
Intelligent Protection Management Corp. → Advanced Technology Distributors (IT/telecom/connectivity/managed-services business)—
Forte Technologies → Business Cyber Security Solutions (BCSS)—
EC-Council → Cyber Insurance Academy—