Daily brief: Monday 19 October 2026
Attackers abused ConnectWise Cloud Backup's Microsoft 365 app to get into tenants, a SiteGuard WAF flaw is being exploited, Drupal fixed two critical RCE bugs, OpenCode Console API keys were stolen, and building systems are becoming a ransomware target.
Attackers get into Microsoft 365 tenants through ConnectWise Cloud Backup
Attackers used the credentials of ConnectWise Cloud Backup (formerly SkyKick Cloud Backup) to sign in to customers' Microsoft 365 tenants as the app itself, so MFA never applied. Huntress says it found at least 162 affected tenants in its own customer base and saw ConnectWise Cloud Management apps giving themselves directory roles, mostly Exchange Administrator, and in one case Global Administrator. Microsoft has called it an active supply-chain attack. ConnectWise has disabled seven application identities, says scheduled backups are not running, and says it has no signs so far that backup data was taken.
Source: BleepingComputer
SiteGuard WAF flaw exploited to run commands as SYSTEM or root
Japanese vendor SiteGuard has confirmed attacks on a critical command injection flaw, CVE-2026-106931, in SiteGuard Server Edition. It affects the statistics function, which is on by default, in versions for Apache httpd, Nginx and IIS. Fixed versions are 8.00 Update 5, or 7.00 Update 6 on FreeBSD, and the vendor also offers a file-replacement patch for systems that can't be upgraded, including end-of-life versions. JPCERT/CC has issued a warning.
Source: BleepingComputer
Drupal patches two critical remote code execution flaws
Drupal has fixed CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module. The core flaw can't be exploited with core alone, but contributed modules or custom code can open a path, including at least one that needs no login. Fixed releases are Drupal core 10.6.19, 11.3.19 and 11.4.10, and Entity List 3.0.10. Drupal's security team warned that exploits might appear within hours or days.
Source: BleepingComputer
OpenCode Console breach exposes users' AI API keys
OpenCode says API keys belonging to 1.4% of its Console users were stolen in what it calls a large-scale distillation attack, and the keys have been used to run up unauthorised charges. It emailed affected accounts on 17 October and says it is working with Google, OpenAI and Anthropic. The company says the incident is ongoing and it can't share more detail yet.
Source: Hugging News
Attackers are going after building systems, not just data
The Register reports a run of attacks on physical systems, including hacked refrigeration in hundreds of French grocery shops and ransomware that hit door access and HVAC monitoring at a Canadian hospital in August. An Armis Labs report found 91% of building automation systems talk over insecure protocols. Dragos estimates fewer than 10% of OT networks worldwide have enough monitoring.
Source: The Register
Weather
Live forecastLoading the forecast…