What to look out for today
- Software supply-chain compromise: a popular developer tool/project (LiteLLM) had its release pipeline abused to push malicious packages/images designed to steal credentials and secrets.
- Internet-facing admin systems under attack: reports indicate active exploitation activity around newly disclosed web/server flaws ("PHP2Shell") and an actively exploited issue in Arista VeloCloud Orchestrator (especially on-prem deployments).
- Knock-on scams: law-enforcement disruption activity highlights ongoing pressure from business email compromise (BEC), ransomware and online scams — expect opportunistic phishing using today’s headlines as bait.
Why this matters to smaller businesses
SMEs are often hit through dependencies: managed IT providers, hosted apps, network/SD‑WAN equipment, and third-party tools used by developers or IT teams. When attackers steal credentials or gain control of an orchestrator/management console, they can pivot quickly into email, file stores, remote access tools, and finance processes.
Even if you don’t use the named products directly, these stories increase risk of credential theft and look‑alike support emails that target busy teams.
Warning signs
- Unexpected MFA prompts, password reset emails, or sign-in alerts (especially for Microsoft 365/Google, finance tools, and remote access).
- New admin accounts, new API keys/tokens, or changes to “trusted devices” that nobody can explain.
- Unplanned changes to networking/Wi‑Fi/VPN/SD‑WAN behaviour, new routing rules, or intermittent site-to-site connectivity issues.
- Security alerts about secrets exposure: environment variables, “.env” files, tokens, or credentials accessed by developer tooling.
- Supplier emails claiming “urgent patches”, “security hotfix”, “new container image”, or “download this installer” that you weren’t expecting.
How attackers may exploit the situation
- Poisoned updates/packages to steal saved browser passwords, cloud tokens, API keys, and credentials from developer/IT machines, then reuse them against email, cloud apps, and CI/CD systems.
- Fast follow-on attacks after credential theft: mailbox rules for invoice interception, data access, and ransomware deployment can happen quickly.
- Targeting internet-facing management systems (e.g., orchestration consoles) to gain higher privileges and alter network access or monitoring.
- Headline-themed phishing using “security advisory” language to trick staff into handing over credentials or approving payment changes.
What to do today
- Tell staff (especially finance and IT): do not trust “urgent security update” emails or payment change requests — verify using a known phone number.
- Check for unusual logins in your key systems (email, finance/payroll, remote access) and lock down any suspicious accounts immediately.
- Reconfirm your payment-change process: dual approval + call-back verification for bank detail changes.
- If you develop software or use containers: pause any unplanned dependency updates, review what was pulled recently, and ensure secrets are not stored on laptops or in plain text config files.
- Backups: confirm backups ran successfully and that you can restore (at least one critical system) quickly.
Ask your IT provider
- Do we run or manage any VeloCloud Orchestrator components (including on-prem) or provide SD‑WAN services that depend on it? If yes, what’s our immediate mitigation/monitoring plan?
- Are you monitoring for credential theft indicators (unusual sign-ins, impossible travel, token reuse) and do you auto-contain suspicious sessions?
- Do we have controls to prevent staff/IT from running unapproved installers/containers on work devices?
- What’s our current position on business email compromise: mailbox rule monitoring, MFA enforcement, and finance approval controls?
Patch watch - only one short paragraph, and only if relevant
Today’s reporting includes active exploitation concerns around newly disclosed web/server flaws ("PHP2Shell") and an actively exploited issue in Arista VeloCloud Orchestrator (notably on-prem). If you host public-facing services or have on-prem network management consoles, treat this as an urgent “confirm exposure + confirm mitigations/updates applied” check with your IT provider.
One action today
Send a 5-minute internal note today: “No payment detail changes or urgent ‘security update’ downloads without call-back verification and IT approval,” and remind staff to report unexpected MFA prompts immediately.
Related Actions On Cyber resource
Actions On Cyber checklist: “Stop payment diversion (BEC) — call-back verification and dual approval”
Sources
- LiteLLM release pipeline hacked to distribute info-stealer malware (BleepingComputer)
- Amazon says PHP2Shell exploitation began 4 days before patches (BleepingComputer)
- Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed (The Hacker News)
- Arista patches new VeloCloud Orchestrator zero-day exploited in attacks (BleepingComputer)
- Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks (The Hacker News)
- Authorities disrupt nearly 11,000 cybercrime networks in Africa (BleepingComputer)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.