Attacks on Arista VeloCloud and Collabora/Nextcloud have been noted
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued warnings regarding active cyberattacks exploiting critical vulnerabilities in two software products: Arista VeloCloud Orchestrator (VCO) and the Collabora Online Built-in CODE Server used within Nextcloud. The first vulnerability, identified as CVE-2026-114625, is a SQL injection flaw in Arista VCO that allows unauthorized network access to privileged internal functions, potentially enabling attackers to impersonate superusers. Arista has released patches for specific versions and provided indicators of compromise, including specific IP addresses, while advising administrators to restrict internet access via firewalls until updates are installed. The second vulnerability, CVE-2026-110447, affects the Collabora Online server during restarts or upgrades, allowing unauthenticated command execution through the proxy.php file. Developers note that disabling the app in Nextcloud does not mitigate the risk, requiring users to update to version 26.4.303 or later, which mandates Nextcloud version 30 or newer.
The German Federal Administration’s Computer Emergency Response Team, known as CERT-Bund, issued a warning regarding a series of severe vulnerabilities affecting WatchGuard security appliances. The advisory highlights eighteen distinct flaws, seventeen of which impact Fireware OS, the Linux-based operating system used by the company's devices, while one affects the associated Windows VPN client. Seven of these issues carry Common Vulnerability Scoring System values ranging from 9.1 to 9.5 out of 10.0, classifying them as critical. CERT-Bund assigned its own maximum severity rating of 10.0 to the collective threat posed by these gaps. Several of the identified weaknesses are exploitable only under specific configurations, such as when the Access Portal or SIP-proxy is enabled, when appliances operate as a FireCluster, or when running in FIPS mode with an external log server. Some vulnerabilities allow remote, unauthenticated attackers to execute arbitrary code, sometimes with root privileges, or to launch denial-of-service attacks that render the equipment unusable. Other flaws permit the bypass of security barriers. Although WatchGuard stated that it has no knowledge of ongoing exploitation for any of the eighteen bugs, the agency noted that this status could change rapidly. Customers are urged to update their systems immediately. Those using affected appliances should install Fireware OS version 2026.4 or 12.12.4. Owners of T15 and T35 models need to upgrade to version 12.5.22, while users of the VPN client should move to version 2026.4. Separately, the United States Cybersecurity and Infrastructure Security Agency warned of active cyberattacks targeting Arista VeloCloud Orchestrator and the Collabora Online Built-in CODE Server within Nextcloud environments. CISA reported that a SQL injection flaw in the on-premise version of Arista VeloCloud Orchestrator is currently being exploited over the internet. This vulnerability, designated CVE-2026-114625 with a CVSS score of 9.4, allows network-based attackers to access privileged internal functions and manipulate the orchestrator. Authenticated users can exploit the bug to impersonate a Superuser Operator, gaining access to features normally restricted from the internet. Arista has released fixed versions 5.2.3.18, 6.1.3.10, and 6.4.2.12. Since the software is reachable by default and lacks configuration options to reduce exposure, administrators should restrict access via firewalls and virtual private networks until patches are applied. Arista has already secured its hosted instances and published indicators of compromise, including attacker IP addresses 74.82.197.86 and 38.54.50.151, which admins should block and search for in logs. CISA also flagged attacks against the Collabora Online Built-in CODE Server. A flaw in the proxy.php file, tracked as CVE-2026-110447 with a CVSS score of 9.2, enables unauthenticated attackers to inject commands into the operating system, executed under the web server user account. These exploits function only while the built-in server is not running, such as during container restarts, upgrades, or crashes. Disabling the application in Nextcloud does not provide protection; updating to version 26.4.303 or later is required. Standalone Collabora servers remain unaffected. Users of unsupported Nextcloud versions up to and including 29 must either update Nextcloud or remove the app, as the patched version requires Nextcloud 30 or newer. Initial reports in the Collabora issue tracker date back to September 11 of this year, indicating that webshells have been installed on affected servers since at least that time. Administrators are advised to inspect their instances for signs of intrusion and apply updates promptly.
Go to the primary sources (11)
The official sources this coverage is built on. Read them directly to bypass framing.
A hospital in Germany was found to have significant cybersecurity vulnerabilities, including an open Wi-Fi network and default login credentials ('admin') that could allow unauthorized access to critical areas such as emergency rooms and operating theaters. The issue was brought to light by a whistleblower who informed heise online, which verified the problem on-site. Despite being alerted, the hospital initially ignored the warnings and only addressed the issue after further pressure from heise online. The delay in fixing the vulnerability was partly due to staff vacations. Experts like Martin Tettke emphasize that this case highlights failures across multiple levels, including improper setup by service providers, inadequate security checks by the hospital, and poor organizational practices. Tettke stresses the importance of separating networks for administration, medical devices, and access control systems, as well as the need for proper prioritization of IT risks in hospitals, which often lack sufficient resources.
Bias read (Center): The article presents a factual account of a cybersecurity incident in a German hospital, focusing on technical and organizational shortcomings rather than taking a clear ideological stance. It includes expert opinions and does not favor any particular political viewpoint or agenda.
Why factuality (85): The article provides specific details about an incident involving insecure WLAN access, default credentials, and unlocked doors in a hospital. These claims are supported by the mention of a whistleblower who alerted the reporter, and the verification process described suggests some level of fact-che
Why objectivity (75): The article presents the situation as a clear case of organizational failure without explicitly giving the hospital’s perspective. While it quotes experts like Martin Tettke, it does not provide counterpoints or balance from the hospital’s side. The language implies criticism toward the hospital’s a
Global authorities issued urgent warnings regarding two critical security vulnerabilities in PHP, designated CVE-2026-109618 and CVE-2026-109619, which have been nicknamed 'php2shell'. The severity of these flaws prompted organizations worldwide, including government agencies in Denmark, Finland, France, and Germany, to temporarily take their websites offline as a precautionary measure while awaiting patches. Cybersecurity firms such as Cloudflare and Amazon reported millions of exploit attempts beginning days before the public disclosure, indicating active exploitation in the wild despite a lack of confirmed successful breaches at the time of reporting. Updated PHP packages began rolling out late Wednesday evening, with distributions like Debian and Fedora releasing fixes after initial delays caused by the rushed nature of the vulnerability disclosure.
Bias read (Center): The article reports on a technical cybersecurity incident involving software vulnerabilities and patch management. While it mentions government entities taking action, the focus remains strictly on the technical impact, the timeline of the exploit, and the availability of software updates rather on
Why factuality (85): The article accurately reflects the severity and global nature of the incident described in the primary source, noting the widespread takedown of websites due to lack of patches. However, it introduces specific real-world details (e.g., Charite, berlin.de, specific countries) that are not present in
Why objectivity (70): The tone is somewhat sensationalist, using terms like 'rarely experienced scale' and comparing the event to major historical breaches like Heartbleed. While the comparison helps convey severity, the phrasing leans toward dramatic effect rather than purely neutral reporting. The statement that organi
Die WeltIndependent🔒CenterFactual: no official source document/info detectedObjective 80
The provided text consists solely of a headline stating that a severe security vulnerability has been discovered, prompting several German federal states to take their websites offline. No further details regarding the nature of the flaw, the specific states involved, or the timeline of the incident are included in the supplied excerpt.
Bias read (Center): The input text is limited to a single headline without any body content, making it impossible to assess framing, word choice, or sourcing. While the subject involves government infrastructure (politics), there is no evidence of bias in the available fragment, resulting in a neutral classification.
Why factuality: no official source document/info detected
Why objectivity (80): The tone is standard journalistic reporting. The word 'Gravierende' (severe/grave) is somewhat dramatic but acceptable within the context of reporting on a significant security incident. There is no overt bias or emotional manipulation evident in the brief snippet.
Focus OnlineIndependentCenterFactual: no official source document/info detectedObjective 45
The provided text consists solely of a headline stating that a severe security vulnerability threatens websites worldwide. No further details, context, or specific information regarding the nature of the flaw, affected systems, or mitigation strategies are included in the supplied excerpt.
Bias read (Center): The subject matter concerns cybersecurity and technology infrastructure, which is generally apolitical. The fragmentary nature of the text prevents any assessment of framing or bias, resulting in a neutral classification.
Why factuality: no official source document/info detected
Why objectivity (45): The word 'Gravierende' (grave/critical) is standard journalistic terminology for high-severity issues. The tone seems neutral based on the limited text, but the absence of body copy limits the evaluation of potential spin or balance.
The German Federal Administration’s Computer Emergency Response Team (CERT-Bund) has issued a warning regarding 18 critical security vulnerabilities affecting WatchGuard security appliances. Seventeen of these flaws impact the Fireware OS operating system, while one affects the associated Windows VPN client. The vulnerabilities include remote code execution capabilities, some allowing root access, denial-of-service attacks, and security barrier bypasses, with seven rated between 9.1 and 9.5 on the CVSS scale. Although WatchGuard states there is currently no evidence of active exploitation, the CERT-Bund rates the overall risk as maximum severity. Users are advised to urgently update their systems to specific patched versions such as Fireware OS 2026.4 or 12.12.4 to mitigate these risks.
Bias read (Center): The article reports on a technical cybersecurity issue involving software vulnerabilities and patching advice. While it involves national infrastructure security, the content is purely technical and factual, lacking political debate, partisan framing, or ideological conflict. It falls under apolitic
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued warnings regarding active cyberattacks exploiting critical vulnerabilities in two software products: Arista VeloCloud Orchestrator (VCO) and the Collabora Online Built-in CODE Server used within Nextcloud. The first vulnerability, identified as CVE-2026-114625, is a SQL injection flaw in Arista VCO that allows unauthorized network access to privileged internal functions, potentially enabling attackers to impersonate superusers. Arista has released patches for specific versions and provided indicators of compromise, including specific IP addresses, while advising administrators to restrict internet access via firewalls until updates are installed. The second vulnerability, CVE-2026-110447, affects the Collabora Online server during restarts or upgrades, allowing unauthenticated command execution through the proxy.php file. Developers note that disabling the app in Nextcloud does not mitigate the risk, requiring users to update to version 26.4.303 or later, which mandates Nextcloud version 30 or newer.
Bias read (Center): The article reports on cybersecurity vulnerabilities and patch recommendations based on technical advisories from CISA, Arista, and Collabora. It uses neutral, factual language typical of technology journalism, focusing on technical specifications, CVE identifiers, and mitigation steps rather than政治
How each side covered it
The same event, grouped by the political lean of the outlets covering it.
progressive
center
conservative
★
How each side covered it
Support independent, bias-aware news and unlock the social pulse, community voting, and every other Supporter feature.
Germany
