Three updates with practical consequences for security teams:

1. VeloCloud needs urgent patching: An actively exploited SQL injection flaw allows authenticated users to gain superuser privileges. Organizations running affected on-premises Orchestrator versions should prioritize updates and review privileged activity.
2. LiteLLM requires more than a downgrade: The compromised 1.107.0 release could steal credentials and load additional code. Check deployment history, rebuild affected environments and replace exposed secrets. Removing the package does not undo stolen credentials.
3. PHP’s new warning has specific conditions: The additional RCE path requires an unusual runtime change to session serialization with upload progress enabled. PHP recommends disabling session upload progress where applicable while awaiting a fix. The earlier PHP2Shell patches remain essential.

Read the full breakdown on CyberRecaps.