Threat Response Hub
Clear, practical response guides for the threats that matter right now. Each one covers what to do in the next 24 hours, how to check exposure and how to hunt for compromise. Written for businesses, internal IT teams and MSPs.
Latest Threat Responses
Newest first. Each guide is kept up to date as advisories change, with severity based on the published advisory.
Last updated 23 October 2026, 17:30 BST.
HPE Aruba AOS-8 and AOS-10 Critical Flaws
Eight rated CVSS 10.0, 72 CVEs
HPE fixed 72 flaws in the software behind Aruba controllers, gateways and access points, most needing no login. Upgrade to a fixed release, lock down management access and hunt for abuse.
VeloCloud Orchestrator Zero-Day
CVSS 9.9, actively exploited
Any logged-in user of an on-premises VeloCloud Orchestrator, even read-only, can gain operator control across every tenant. Upgrade, restrict access to the portal and hunt for abuse.
GLPI Unauthenticated SQL Injection
No CVE yet
GLPI 11.0.8 and earlier can be attacked without logging in. Upgrade to 11.0.9, keep GLPI off the open internet and hunt for planning.php abuse.
Linux KSMBD Remote Code Execution
CVSS 9.0, no patch yet
Two remote code execution flaws in the in-kernel SMB server with no fix yet. Find hosts running KSMBD, disable it, keep port 445 off the internet and watch for crashes.
Railway Environment-Variable Breach
Platform breach, secrets exposed
An attacker decrypted some customer environment variables, exposing API keys and database credentials. Rotate secrets, hunt for misuse and contain access.
ConnectWise Cloud Backup Compromise
Supply chain, Microsoft 365 access
Stolen app secrets were used to reach Microsoft 365 tenants. Disable the app, preserve logs, check exposure with the published app IDs and hunt with IOCs.
GitLab CVE-2026-110264
CVSS 10.0, unauthenticated RCE
Unauthenticated remote code execution in self-managed GitLab CE and EE. Patch to a fixed version, check exposure and hunt for signs of compromise.
LiteLLM 1.107.0 Supply Chain Attack
Malicious release
LiteLLM 1.107.0 on PyPI and Docker shipped a credential stealer. Find affected hosts, rebuild from a clean pinned version and rotate every exposed credential.
PHP2Shell
CVSS 9.2
Fixes are out for CVE-2026-109618 and CVE-2026-109619. Check exposure, update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and hunt for compromise.
How to Use These Guides
Every guide follows the same structure, so your team knows where to look under pressure.
Next 24 hours
The short list of actions to take first: patch, disable, restrict or rotate.
Proactive checks
Find affected systems and confirm exposure across your own estate or your clients'.
Reactive hunting
Free scripts, IOCs and detection queries to look for signs of compromise.
Detect and Remediate Threats Across Your Estate
CybaOps monitors your endpoints, servers, cloud and SaaS platforms, whether that's your own business or your clients'. Our SOC runs these threat hunts as new threats land, alerts on suspicious activity and drives remediation through to a verified fix.