This Week in Business IT: Arista Flaw, Plex Bugs

Arista VeloCloud Orchestrator SQL Injection (CVE-2026-114625)

CISA added this one on October 23 with a federal remediation deadline of October 26 — about as tight a turnaround as the catalog gets. It's a SQL injection bug in the orchestrator that manages Arista's SD-WAN appliances, which means a successful attack could give someone a foothold into how traffic routes across your whole wide-area network. If you run VeloCloud gear, whether directly or through an MSP, check the full write-up and patch guidance here and get it done this week, not next.

Collabora Online Built-in CODE Server OS Command Injection (CVE-2026-110447)

Also added October 23 with the same October 26 deadline, this one hits organizations self-hosting Collabora Online for document editing, often paired with Nextcloud or similar file platforms. OS command injection means an attacker who reaches the service can run commands on the underlying server. If your team edits office documents through a self-hosted Collabora instance, confirm you're patched or pull it offline until you are.

EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931)

This one's federal due date already passed — October 23 — so if you're running SiteGuard Server Edition and haven't patched, you're past the window CISA gave federal agencies and should treat it as overdue on your own network too. Details and remediation steps are in our SiteGuard guide.

Plex Media Server: Four Separate Flaws

CISA added four distinct Plex Media Server vulnerabilities this week — CVE-2026-96656, CVE-2026-96655, CVE-2026-96654, and CVE-2026-96652 — covering path traversal, two server-side request forgery issues, and a URI-scheme handling bug. Due dates run from October 23 through November 3 depending on the specific CVE. Plex shows up more often than people expect on small business networks, usually because someone set up a personal media server years ago and it never left the firewall exception list. If that's you, check our combined Plex vulnerability guide, patch or isolate the server, and ask whether it needs to be reachable from outside your network at all.

Siemens Software Center Uncontrolled Search Path (CVE-2026-110936)

Added October 20 with a November 3 deadline, this flaw affects the search path handling in Siemens Software Center, a tool used widely in manufacturing and industrial environments across Texas. An uncontrolled search path can let an attacker plant a malicious file that gets executed instead of the legitimate one. If you run Siemens industrial software, see the Siemens Software Center guide and loop in whoever manages your OT network segment.

None of these eight entries show confirmed ransomware use yet, but "unknown" on the CISA catalog means unverified, not safe. For a broader view of what's rated critical versus moderate across Windows and Mac environments this month, our team keeps a running, rated list at LayerLogix Academy's vulnerability tracker. If patch cadence across your network feels like guesswork rather than a schedule, a proper vulnerability assessment will tell you exactly where the gaps sit.

Suspicious White Powder Letters Sent to Election Officials and Media

The FBI's Internet Crime Complaint Center published an alert on October 23 about suspicious letters containing white powder mailed to state and local election officials, media organizations, and public and private polling companies — full PSA here. For the overwhelming majority of Texas businesses, this needs no direct action; it's targeted at a narrow set of organizations. If your business falls into one of those categories — local government, media, or polling — now's a good time to remind front-desk and mailroom staff on handling procedures for suspicious mail, and to make sure whoever opens the mail knows who to call first.

Critical Vulnerability Alert: PHP Core

The second IC3 alert this week, also dated October 23, flags a critical vulnerability in PHP Core — source here. PHP runs underneath a huge share of small business websites, including most WordPress installs, so this one applies more broadly than the mail alert above. If your site or any internal web app runs on PHP, check with whoever hosts or maintains it that a patch has been applied or is scheduled, and don't assume your hosting provider has it handled automatically — ask directly. This is also a reasonable week to confirm your incident response plan actually names who makes that call when a critical web vulnerability drops with no patch yet available.

Texas businesses working toward CIS Controls IG1 under SB 2610's liability protections should note that patch management and vulnerability tracking are baked into those 56 safeguards — weeks like this one are exactly why that control exists.

Patch cadence and threat alerts like these are the kind of thing continuous monitoring catches before they turn into a weekend phone call. If you want that visibility without hiring it in-house, our threat monitoring team watches for exactly this pattern of newly exploited CVEs and fraud campaigns.

For the fundamentals behind all of this — patch management, phishing recognition, basic network hygiene — our LayerLogix Academy has plain-language guides built for business owners, not just IT staff. And if you're not sure where your own network stands against this week's list, get a free IT assessment and find out before an attacker does.