Today's outlook

ConnectWise Cloud Backup credential abused to sign in to 173 Microsoft 365 tenants; three flaws CISA lists as exploited

By The IT Security Desk

Good morning. BleepingComputer reported that ConnectWise shut down customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after hackers accessed application identities and compromised Microsoft 365 tenants. The Hacker News reported that unknown threat actors are abusing a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup to sign in to 173 customer M365 environments in an active campaign. If your organisation uses ConnectWise Cloud Backup or SkyKick Cloud Backup for Microsoft 365, review your M365 sign-in and audit logs for access tied to that application identity and revoke it; ConnectWise has already cut off the service.

CISA's Known Exploited Vulnerabilities catalogue lists three flaws as known to be exploited. CVE-2026-0322 affects Palo Alto Networks PAN-OS; Palo Alto Networks' advisory lists the fix in 10.2.0, and the entry is rated CVSS 7.2. CVE-2026-96951 affects Microsoft Windows Server and is rated CVSS 8.8; Microsoft's advisory says to apply the named patch, with the fix in build 10.0.14393.9612. CVE-2026-104935 affects Ivanti Connect Secure 22.8 and is rated CVSS 8.6; follow Ivanti's advisory for the fixed release and any interim mitigation. For all three, CISA directs organisations to apply the vendor fixes in line with BOD 26-04 — prioritise them.

Google's Chrome release advisory lists fixes for CVE-2026-110165, CVE-2026-110161 and CVE-2026-110159, each rated CVSS 9.6, with the fix in 155.0.8059.79. Update to Chrome 155.0.8059.79. BleepingComputer reported that Drupal patched two critical remote-code-execution flaws affecting any supported version of the content management system, and warned exploits may emerge soon. BleepingComputer also reported that researchers warned hackers could soon exploit a maximum-severity flaw in Magento and Adobe Commerce that allows arbitrary PHP code execution on store servers.

Three further items round out the day. The Hacker News reported a malicious npm package, "imgdecode," part of a campaign it calls MALFEX, uploaded on 30 September 2026 by a user named "malfexteste8" and downloaded 979 times, which hides a shellcode loader in a Windows native addon. SecurityWeek reported that Israeli company Discover-Tech's ads doubled as a delivery channel for Candiru's zero-click spyware, letting threat actors fingerprint and track devices at scale and infect selected targets. The Register reported that cybercriminals are moving beyond stealing data to attack physical building systems.