ConnectWise Cloud Backup credential abused in M365 attacks
A compromised credential for ConnectWise Cloud Backup (ex-SkyKick) let attackers sign in to 162+ Microsoft 365 tenants and self-grant admin roles. Disable the app and audit now.
Newsroom
Russia reportedly detains DataSuckers extortion suspects
Russian and Kazakh media report four suspects tied to the DataSuckers extortion crew — behind breaches at Dodo Pizza, Tez Tour and Ukraine's ATB — three detained, one at large.
MALFEX npm campaign resurfaces with imgdecode loader
imgdecode, live on npm with 979 downloads, loads a Windows native addon that pulls shellcode from GitHub and injects it into dllhost.exe — the newest package in the MALFEX campaign.
Public PoC roots OpenBSD 7.9 via a 37-year-old shmat bug
Calif published a full OpenBSD 7.9 local-root exploit chaining a 1988-era shmat integer overflow with a kernel use-after-free, bypassing KARL, SMAP and SMEP. No CVE assigned.
Unit 42 details PEERSTITCH, a memory-only FortiGate implant
Unit 42 says CL-STA-0954 (Mandiant: UNC5820) chained FortiJump and CVE-2025-61624 to deploy PEERSTITCH, a disk-less ARM64 FortiOS implant, against a telecom MSP.
Adobe patches CVSS 10 Magento RCE (CVE-2026-103849)
CVE-2026-103849 is an unauthenticated, CVSS 10.0 template-engine injection in Adobe Commerce and Magento Open Source through 2.4.9. Patch APSB26-153 shipped; no exploitation seen yet.
AOMEI Backupper update servers hijacked to push a backdoor
GTIG and ManageEngine say attackers tampered with AOMEI Backupper's update files in minutes-long windows from May to July 2026, delivering the SHINYROAD backdoor. No fixed version yet.
BAE security incident halts US bankruptcy court notices
A security incident at BAE Systems' Bankruptcy Noticing Center took federal court notice systems offline from October 9. The AOUSC says BAE is still investigating; no data loss confirmed.
BeyondTrust patches Remote Support zero-day exploited since August
CVE-2026-102764 (CVSS 9.3) let a China-nexus actor Mandiant calls Armory Castle take over self-hosted BeyondTrust Remote Support appliances from August 29. Patch now.