Arista VeloCloud Orchestrator Flaw Rated CVSS 10.0 Actively Exploited in Wild

·1 views

Arista disclosed CVE-2026-16812, a maximum-severity OS command injection vulnerability in on-premises VeloCloud Orchestrator (VCO), confirming it was already under active exploitation when the advisory was published on July 27, 2026. The flaw allows unauthenticated remote attackers to access privileged internal functionality on the VCO host, potentially extending control to all VeloCloud Edge devices managed by the orchestrator. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and set a July 30, 2026 remediation deadline for Federal Civilian Executive Branch agencies. Arista has released patches across four affected release branches — versions 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1 — while its hosted and dedicated VCO instances were already remediated in advance. Organizations unable to patch immediately are advised to block three attacker-attributed IP addresses and restrict VCO web interface access to trusted administrative networks only.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Free Collection of 200+ AI Coding Prompts Launched for Cursor, Claude and Codex

Developer platform iHateReading has published a free collection of over 200 prompt rules designed for AI coding tools including Cursor, Claude Code, and OpenAI Codex. The collection covers a wide range of tech stacks and tools, including Next.js, React, Tailwind, Firebase, Supabase, Stripe, and several ORM and payment integrations. It was created to save developers time by eliminating the need to rewrite repetitive prompts for common coding tasks such as building responsive UIs or integrating authentication. Users can browse the collection at ihatereading.in/cursor-rules, select relevant rules, and paste them directly into their preferred AI coding agent. The creator drew partial inspiration from the open-source GitHub repository awesome-cursorrules and says more rules are being added over time.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

EU AI Act High-Risk Provisions Now Enforceable as Agent Governance Gap Widens

The European Union AI Act's high-risk compliance requirements, covering Articles 9, 14, and 43 on risk management, human oversight, and conformity assessment, became enforceable on August 2, 2026. The legislation applies to organizations deploying autonomous AI agents, even though the Act was drafted before agentic systems existed and does not explicitly address them. Industry research indicates that 92% of enterprise CISOs lack visibility into their AI agents, and 95% say they could not contain a compromised one. Regulatory standards bodies including NIST have yet to publish agent-specific guidance, with dedicated frameworks not expected before late 2026 at the earliest. The gap between the pace of AI agent deployment and available governance infrastructure presents an immediate compliance challenge for affected organizations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Kubernetes Dashboard Maker Argues AI Agents Could Render Its Own Product Obsolete

The team behind a Kubernetes dashboard has published a candid self-critique arguing that AI agents may fundamentally undermine the need for traditional cluster management UIs. The piece cites internal benchmarks showing an AI agent diagnosed 52 cluster faults more accurately than manual kubectl commands while using a quarter of the tool calls, suggesting agents need structured data, not visual interfaces. The authors reference industry voices including Satya Nadella and Andrej Karpathy, both of whom have argued that GUIs built for human eyes are poorly suited to AI consumption. However, the team draws a distinction between operational dashboards—used to manually run clusters—and supervisory interfaces needed for auditing, approving, and interpreting agent actions. Their conclusion is that dashboards will not disappear but will shift from active control surfaces to oversight tools, much like an air traffic control tower rather than a cockpit.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GitHub Actions Cron Jobs Routinely Run Hours Late With No Alerts, Dev Finds

A developer running a public test repository found that GitHub Actions scheduled workflows consistently started hours behind their set times, with an average delay of 2 hours and 42 minutes across seven days. The every-five-minute workflow fired only 97 times out of roughly 2,016 expected slots in a week, a 5% execution rate. GitHub documents its schedule trigger as best-effort, but the developer argues the bigger problem is the complete absence of notifications when runs are skipped or silently disabled. GitHub itself acknowledged in June that scheduled job drift had worsened as workflow volume grew over 30% in two months. In response, the developer built a read-only GitHub App called Cronwake that monitors scheduled workflows across an organisation and sends alerts via Slack, Discord, or PagerDuty when an expected run fails to appear.

0 comments Read more at DEV Community