Security news.
Major cloud identity compromises and critical remote exploitation flaws lead today's security briefing. ConnectWise has suspended its Cloud Backup service following supply-chain attacks on Microsoft 365 tenants, while CISA and researchers issue urgent alerts regarding an actively exploited zero-day in BeyondTrust Remote Support. Administrators also face high-priority patching demands across SiteGuard WAF, Drupal, and Adobe Commerce platforms.
ConnectWise Suspends Cloud Backup Over M365 Breaches
ConnectWise disabled seven application identities and suspended customer access after threat actors abused compromised credentials to breach dozens of Microsoft 365 tenants.
CISA Adds Actively Exploited BeyondTrust Zero-Day to KEV
CISA issued an urgent patching warning and cataloged CVE-2026-102764, a critical authentication bypass flaw in BeyondTrust Remote Support exploited in targeted espionage attacks since late August.
SiteGuard WAF Flaw Targeted for Root Command Execution
Threat actors are actively exploiting an OS command injection vulnerability in SiteGuard Server Edition to execute commands as root or SYSTEM on affected infrastructure.
Drupal Patches Critical RCE Vulnerabilities
Drupal released critical security updates addressing two remote code execution flaws affecting all supported versions of the CMS, warning that public exploits may surface quickly.
Critical Flaw in Adobe Commerce and Magento Enables Code Execution
Researchers warn that attackers could soon exploit CVE-2026-103849, a maximum-severity vulnerability in BlockStrap that enables arbitrary PHP code execution on store servers.
AOMEI Backupper Update Infrastructure Hijacked to Serve Backdoors
Attackers briefly manipulated vendor update servers in five- to ten-minute windows to deliver malicious backdoors to systems checking for AOMEI Backupper updates.
Targeted Online Ads Deliver Candiru Zero-Click Spyware
Researchers discovered that zero-click exploits delivering Candiru spyware were distributed via targeted advertising networks without requiring any user interaction beyond ad rendering.
Malicious npm Package Hides Shellcode Loader in Native Addon
The "imgdecode" npm package, part of the MALFEX supply-chain campaign, was caught deploying an obfuscated Windows native addon to drop shellcode.