Security news.
Major cloud ecosystems and edge devices face active threats this week, led by a ConnectWise supply-chain breach exposing hundreds of Microsoft 365 tenants and a critical zero-day exploited in BeyondTrust Remote Support. Administrators also face urgent patching demands for critical remote code execution flaws in Drupal and Adobe Commerce. Additionally, new revelations spotlight zero-click mobile surveillance campaigns and malicious npm packages weaponizing native Windows addons.
ConnectWise Supply-Chain Attack Breaches M365 Tenants
Attackers compromised application identities in ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to at least 173 customer Microsoft 365 environments.
CISA Urges Action on Actively Exploited BeyondTrust Zero-Day
CISA added CVE-2026-102764 to its KEV catalog following reports that Chinese state-sponsored group Armory Castle has weaponized the BeyondTrust Remote Support flaw in the wild since August.
Drupal Patches Critical Remote Code Execution Vulnerabilities
Drupal released emergency fixes for two critical RCE flaws affecting all supported versions of the CMS and warned that exploitation in the wild could emerge shortly.
Critical Flaw in BlockStrap Threatens Magento Servers
Security researchers warned that attackers could soon exploit maximum-severity vulnerability CVE-2026-103849 to execute arbitrary PHP code across Magento and Adobe Commerce deployments.
Ad Platform Used to Deliver Candiru Zero-Click Spyware
Israeli ad firm Discover-Tech served as a delivery pipeline for Candiru spyware, allowing attackers to profile targets and deploy zero-click exploits simply by rendering online ads.
MALFEX npm Package Drops Shellcode Via Windows Native Addon
The malicious package 'imgdecode' was discovered abusing native Windows addons to conceal a shellcode loader as part of the broader MALFEX software supply-chain campaign.
AOMEI Backupper Update Servers Hijacked to Distribute Backdoors
Attackers temporarily altered files served by vendor update infrastructure in five-to-ten-minute windows between May and July to drop malware on updating Windows endpoints.
Burger King Japan Breach Exposes Over 11 Million Records
Threat actors compromised a server belonging to the fast-food chain's Japanese subsidiary, leaking 11.18 million customer records.