Loki Intelligence — Security Briefs · Published
Daily Security Brief: Two CISA KEV Additions and AI-Driven Ransomware Tooling
Two newly listed exploited vulnerabilities in Collabora Online and Arista VeloCloud Orchestrator, plus reporting on ransomware affiliates using AI agents, set today's risk picture. Teams should prioritize checking exposure to the KEV-listed products, then review AI usage controls and applicable industrial and medical advisories.
Signal 01 · CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-110447, an OS command injection vulnerability in the built-in CODE Server of Collabora Online, to its KEV Catalog based on evidence of active exploitation.
Why it matters: Teams running Collabora Online should confirm whether the affected component is deployed, apply vendor fixes or mitigations, and prioritize it as a known exploited issue.
Source: CISA
Signal 02 · CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA listed CVE-2026-114625, a SQL injection vulnerability in Arista VeloCloud Orchestrator, in its KEV Catalog after seeing evidence of active exploitation.
Why it matters: Organizations using VeloCloud Orchestrator should check their version, patch according to vendor guidance, and review access to the management interface.
Source: CISA
Signal 03 · The Hacker News
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Researchers found an AI-driven intrusion ecosystem operated by affiliates of the INC and The Gentlemen ransomware groups, built around an autonomous framework called Phantom.
Why it matters: Automated, agent-assisted intrusion can speed up attacker activity, so basic hygiene such as patching, least privilege and detection coverage matters more, not less.
Source: The Hacker News
Signal 04 · CISA
Managing AI Token Consumption for Operational Resilience
CISA, the Canadian Cyber Centre and partners published joint guidance on understanding and managing token usage when organizations rely on third-party AI services.
Why it matters: Teams building on AI services should set usage limits, monitoring and fallback plans so runaway or abusive token consumption does not become an outage or cost incident.
Source: CISA
Signal 05 · CISA
Siemens WinCC
A CISA advisory describes a database privilege escalation vulnerability in multiple SIMATIC WinCC versions that could let an authenticated database user run commands on the host. Siemens has released new versions.
Why it matters: Operators should plan updates to the fixed versions and restrict database access to only those accounts that need it.
Source: CISA
Signal 06 · CISA
Siemens Capital Embedded AR Classic
CISA reported an out-of-bounds read vulnerability in Siemens Capital Embedded AR Classic that could cause abnormal behavior, instability or denial of service. Siemens has released a new version for affected releases.
Why it matters: Embedded product teams should review the advisory for affected releases and schedule the vendor update.
Source: CISA
Signal 07 · CISA
InterSystems Corporation InterSystems IRIS for Health
A medical advisory covers a vulnerability in InterSystems IRIS for Health where an attacker could view transmitted data and use it to log into the device.
Why it matters: Healthcare IT teams should check affected versions, apply vendor guidance and ensure sensitive data is protected in transit.
Source: CISA
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.