Security news.
Today's security landscape is dominated by active zero-day exploitation of enterprise edge devices and supply chain compromises targeting cloud environments. BeyondTrust Remote Support has come under targeted state-sponsored attack, prompting an urgent CISA advisory and KEV addition. Meanwhile, credential leaks and malicious packages continue to threaten IT ecosystems spanning Microsoft 365 tenants down to developer registries.
CISA Urges Emergency Patching for BeyondTrust Remote Support Flaw
CISA added CVE-2026-102764 to its KEV catalog following active zero-day exploitation by Chinese state-sponsored group Armory Castle to breach appliances and establish persistence.
Compromised ConnectWise Credential Opens 173 Microsoft 365 Tenants to Intruders
Attackers leveraged a single compromised ConnectWise Cloud Backup credential to gain unauthorized access to 173 customer M365 environments across multiple managed service providers.
Malicious 'imgdecode' npm Package Deploys Windows Shellcode Loader
Cybersecurity researchers identified an active MALFEX supply chain campaign leveraging a deceptive npm package to conceal native Windows shellcode loaders.
Maximum-Severity Bug in BlockStrap Threatens Magento and Adobe Commerce
Attackers are positioned to target CVE-2026-103849, a critical flaw that allows unauthenticated arbitrary PHP code execution on underlying e-commerce store servers.
Attackers Hijacked AOMEI Backupper Update Servers to Push Backdoors
Threat actors manipulated update files on vendor servers in recurring 5-to-10-minute windows between May and July 2026, delivering backdoors to endpoints checking for updates.
Ad Platform Doubled as Zero-Click Delivery Pipeline for Candiru Spyware
Targeted online ads served by Israeli firm Discover-Tech were leveraged to track devices and push zero-click Candiru spyware onto high-profile targets without user interaction.
FortiOS Flaw Abused to Deploy Stealthy ARM64 'PEERSTITCH' Malware
Advanced threat actors are exploiting path traversal vulnerability CVE-2025-61624 across Fortinet appliances to deliver in-memory PEERSTITCH implants that bypass VPN controls.
Burger King Japan Data Breach Exposes 11 Million Customer Records
The fast-food chain's Japanese subsidiary confirmed unauthorized server access that compromised the personal records of more than 11.18 million customers.