Dysphoria botnet reaches 200k devices; Arista VeloCloud, n8n zero-days exploited

**Executive summary:** Multiple high-risk incidents are active: the Dysphoria IoT botnet has grown to ~200,000 devices and adopted blockchain-based C2 to resist takedown; Arista's VeloCloud Orchestrator has a maximum-severity command-injection zero-day under active exploitation; n8n patched a sandbox-escape RCE affecting authenticated editors; public exploit code for a vBulletin pre-auth RCE has been released—organizations should urgently patch affected products, review logs for signs of compromise, and isolate or remediate impacted assets.