Daily Briefing

ConnectWise Cloud Backup credential abused to sign in to 173 Microsoft 365 tenants; three flaws CISA lists as exploited

By The IT Security Desk

Good morning. BleepingComputer reported that ConnectWise shut down customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after hackers accessed application identities and compromised Microsoft 365 tenants. The Hacker News reported that unknown threat actors are abusing a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup to sign in to 173 customer M365 environments in an active campaign. If your organisation uses ConnectWise Cloud Backup or SkyKick Cloud Backup for Microsoft 365, review your M365 sign-in and audit logs for access tied to that application identity and revoke it; ConnectWise has already cut off the service.

CISA's Known Exploited Vulnerabilities catalogue lists three flaws as known to be exploited. CVE-2026-0322 affects Palo Alto Networks PAN-OS; Palo Alto Networks' advisory lists the fix in 10.2.0, and the entry is rated CVSS 7.2. CVE-2026-96951 affects Microsoft Windows Server and is rated CVSS 8.8; Microsoft's advisory says to apply the named patch, with the fix in build 10.0.14393.9612. CVE-2026-104935 affects Ivanti Connect Secure 22.8 and is rated CVSS 8.6; follow Ivanti's advisory for the fixed release and any interim mitigation. For all three, CISA directs organisations to apply the vendor fixes in line with BOD 26-04 — prioritise them.

Google's Chrome release advisory lists fixes for CVE-2026-110165, CVE-2026-110161 and CVE-2026-110159, each rated CVSS 9.6, with the fix in 155.0.8059.79. Update to Chrome 155.0.8059.79. BleepingComputer reported that Drupal patched two critical remote-code-execution flaws affecting any supported version of the content management system, and warned exploits may emerge soon. BleepingComputer also reported that researchers warned hackers could soon exploit a maximum-severity flaw in Magento and Adobe Commerce that allows arbitrary PHP code execution on store servers.

Read the full briefing →

Zoom out: The day's news clustered on supply-chain compromise — ConnectWise Cloud Backup and a malicious npm package — alongside three vulnerabilities CISA lists as known to be exploited.

Vulnerability in focus

CVE-2026-0322 — Palo Alto Networks. CVSS 7.2 CISA lists it as known to be exploited.

Affected: panos.

What to do: Follow the vendor advisory for the fixed release and any interim mitigation.

Elsewhere

BleepingComputer: Drupal patches critical RCE flaws, warns exploits may emerge soon Read it
The Register: Cybercrims go beyond stealing data to attack physical building systems Read it

Sources

Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack BleepingComputer
Cybercrims go beyond stealing data to attack physical building systems The Register
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon The Hacker News
Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel SecurityWeek
Drupal patches critical RCE flaws, warns exploits may emerge soon BleepingComputer
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants The Hacker News
Critical BlockStrap flaw lets hackers run code on Magento servers BleepingComputer

Share this issue

Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky

Every briefing is on the site, with the advisory record behind it. All briefings