Tech News, September 24: Arista’s CVSS 10.0 Zero-Day, China’s Broadcom Probe, and Oppo’s Triple-200MP Flagship

Five stories from the last 24 hours: an actively exploited zero-day in enterprise networking gear, SoftBank raising fresh debt to fund its OpenAI position, China probing Broadcom hardware inside state data centers, a hard look at the economics of Europe’s planned AI gigafactories, and a flagship phone shipping today in China with three 200-megapixel cameras.

TL;DR: Patch Arista VeloCloud Orchestrator now (CVE-2026-93952, CVSS 10.0, actively exploited, US federal patch deadline September 25). SoftBank issued $11.1 billion in bonds toward a $64.6 billion total OpenAI commitment. China is surveying Broadcom switches in state data centers. OVHcloud’s CEO says Europe’s AI gigafactory math doesn’t add up yet. Oppo’s Find X10 Pro Max packs three 200MP cameras and an 8,000mAh battery, on sale from September 24 in China.

1. Arista patches an actively exploited CVSS 10.0 zero-day

Arista Networks released emergency patches for CVE-2026-93952, an improper input validation flaw in on-premises VeloCloud Orchestrator (VCO) deployments that carries the maximum CVSS score of 10.0. Arista says the issue was discovered externally and “is known to be actively exploited.” The bug affects VCO On-Prem where certificate-based authentication from VeloCloud Edge to the Orchestrator is configured. To exploit it, an attacker needs network access to the VCO web interface and the public half of the Edge authentication certificate. No tenant or operator credentials, no user interaction, no privileges on the target are required. Successful exploitation gives remote attackers access to privileged internal VCO host functionality and can compromise the confidentiality, integrity, and availability of the orchestrator and the data it manages.

Fixed releases are VCO 5.2.3.16 and 6.4.2.8; patches for the 6.1.x and 7.0.x trains are still pending. Arista reports no definitive indicators of compromise yet, and recommends reviewing VCO web access logs, backend application logs, and system logs for suspicious activity. Deployments that restrict access to the VCO web interface face lower exposure, but patching remains the only real fix.

Why it matters: VCO is the central control plane for VeloCloud SD-WAN deployments. Owning the orchestrator potentially means owning the wide-area network of every enterprise it manages. The flaw is part of a broader burst of zero-days: on Tuesday, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, including the Arista flaw, Check Point flaws (CVE-2026-85102), and an F5 BIG-IP APM remote code execution flaw (CVE-2026-94127). US federal civilian agencies must remediate all of them by Friday, September 25. Private-sector operators should treat that as their deadline too.

2. SoftBank issues $11.1 billion in bonds to fund its OpenAI stake

SoftBank Group issued $11.1 billion in dollar- and euro-denominated bonds, a regulatory filing showed on Thursday. The dollar tranches: $1 billion at 3.5 years, $4.5 billion at 5.5 years, and $4.5 billion at 7.5 years, paying coupons of 8.625%, 9.25%, and 9.75% respectively. Two euro tranches of 500 million each (4 and 6 years) yield 7.125% and 8%. Reuters reports the proceeds will fund the final $10 billion tranche of the $30 billion SoftBank committed to OpenAI, taking its total investment to $64.6 billion when complete. Earlier this month the company issued 1 trillion yen ($6.32 billion) in corporate bonds aimed at retail investors.

Why it matters: SoftBank is now funding frontier AI development with high-yield debt at coupons approaching 10%. The bond market is effectively bankrolling model training runs. (Background: SoftBank’s original $10 billion OpenAI bet, covered here on September 21.)

3. China surveys Broadcom switch use in state data centers

China’s State-owned Assets Supervision and Administration Commission (SASAC) has spent recent weeks surveying how extensively Broadcom’s networking switches are deployed across state-controlled data centers, the Financial Times reported Wednesday. The survey found Broadcom switches could account for as much as 90% of the equipment in use. Based on those findings, SASAC may issue informal guidance directing state-run data centers to scale back Broadcom usage, part of Beijing’s “domestic chips for domestic use” campaign to expand adoption of Chinese-made semiconductors and AI technology across the public sector.

Broadcom competes with Nvidia and Huawei in high-end data center switches in China. Nvidia products have already been barred from state-backed data centers; Broadcom’s switches, the FT notes, remain widely present. Reuters reported it could not independently verify the story, and neither Broadcom nor SASAC commented.

Why it matters: The decoupling of AI infrastructure is moving from GPUs to the networking layer. If SASAC pushes state operators off Broadcom, it hands a large installed base to domestic vendors, and it raises the stakes for every foreign hardware supplier selling into Chinese cloud and AI buildouts.

4. OVHcloud CEO: Europe’s AI gigafactory economics don’t add up

OVHcloud CEO Octave Klaba said operators of Europe’s proposed AI gigafactories would need 300 million to 400 million euros in annual revenue just to break even on facilities built around fast-depreciating graphics chips. A proposed 200-million-euro public commitment to buy AI services over five years (40 million euros a year) would cover only 10 to 15% of required turnover. Klaba estimates an operator would spend at least 600 million euros on chips alone: “The numbers don’t add up.”

The EuroHPC program is seeking industry consortia to build and operate up to seven AI gigafactories for training, fine-tuning, and running models. Klaba also said focus on national markets prevented OVHcloud from joining existing French consortia, arguing national strategies are “doomed to failure” and that gigafactories must operate at European scale.

Why it matters: Europe’s compute-sovereignty push has a financing gap. Unless public orders grow substantially or private demand materializes at European scale, the gigafactories risk being announced but never built.

5. Oppo Find X10 Pro Max: three 200MP cameras, 8,000mAh battery

Oppo launched the Find X10 series in China on September 22, with phones going on sale September 24 through Oppo’s online store. The Pro Max is the headline: three 200-megapixel rear cameras (a 24mm main on a 1/1.3-inch sensor with f/1.5, a 13mm ultrawide, and a 70mm 3x telephoto), a 50MP front camera, MediaTek’s 2nm Dimensity 9600 Pro, a 6.78-inch AMOLED display (2772×1272, 120Hz system-wide and 144Hz in supported games, 2,000 nits peak), and an 8,000mAh battery with 80W wired and 50W wireless charging. It runs ColorOS 17 on Android 17 and carries IP66, IP68, and IP69 ratings. Pricing starts at 6,799 yuan (about $1,015) for 12GB/256GB and reaches 8,999 yuan (about $1,344) for 16GB/1TB. The standard Find X10 starts at 5,499 yuan and the Find X10 E at 4,999 yuan. Oppo has confirmed an international rollout but no US launch is planned.

Why it matters: The megapixel race is officially back, this time with three oversized sensors instead of one, and 8,000mAh batteries are becoming the new flagship baseline in China. Expect these specs to set the template for 2027’s global flagships.

Today’s stories, in numbers

Key takeaways

• If you run Arista VeloCloud Orchestrator on-prem, patch now. CVE-2026-93952 is under active exploitation, needs no credentials, and CISA’s September 25 federal deadline is a reasonable target for everyone.
• Watch the bond market for AI funding signals. SoftBank paying near-10% coupons to fund model training shows how capital-intensive the frontier race has become.
• Hardware decoupling is spreading from chips to switches. Broadcom’s 90% share in Chinese state data centers makes it the next pressure point after Nvidia.
• Europe’s AI infrastructure ambitions need real demand, not announcements. €40M a year in public orders against €300M+ breakeven is a gap, not a plan.

References

• SoftBank issues $11.1 billion in bonds in OpenAI financing push — Reuters, September 24, 2026
• China surveys Broadcom switch use in state data centers, FT reports — Reuters, September 23, 2026
• Arista patches actively exploited VeloCloud Orchestrator zero-day — BleepingComputer, September 2026
• Arista urges immediate patching of exploited VCO zero-day — SecurityWeek, September 2026
• Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances — Help Net Security, September 23, 2026
• OVHcloud CEO says public commitment for EU AI gigafactories too small — Reuters, September 23, 2026
• Oppo Find X10 Pro Max launches with three 200MP rear cameras, Dimensity 9600 Pro SoC — GSMArena, September 2026