TL;DR
ConnectWise Cloud Backup credential breach has compromised 173 Microsoft 365 customer tenants. Drupal released patches for two critical RCEs expected to be exploited imminently. Adobe Commerce faces max-severity RCE risk. Immediate patching and credential rotation required across all affected platforms.
Executive Summary
- ConnectWise Cloud Backup service shut down after attackers obtained Microsoft 365 application identities and breached 173 customer tenants.
- Drupal released patches for two critical remote code execution vulnerabilities affecting all supported versions; researchers warn exploits may emerge soon.
- Adobe Commerce / Magento BlockStrap maximum-severity flaw allows arbitrary PHP code execution on affected store servers.
- Candiru spyware was delivered via targeted online advertisements in zero-click attacks on Al Jazeera Media Network devices.
- MALFEX campaign distributes malicious npm package 'imgdecode' containing Windows shellcode loader.
Top Threats Today
1. ConnectWise Cloud Backup Credential Compromise Exposes 173 Microsoft 365 Tenants
Severity: HIGH Affected: Technology
Attackers obtained a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick) and used it to gain unauthorized access to customers' M365 environments [1]. ConnectWise has shut down customer access to the service after the breach was discovered [2]. Unknown threat actors abused the compromised application identity to access 173 Microsoft 365 tenants [1]. The attack represents a significant supply-chain compromise affecting MSP and cloud backup customers.
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- All ConnectWise Cloud Backup customers must immediately rotate Microsoft 365 credentials and application identities
- Review M365 audit logs for unauthorized access during the compromise window
- Enable conditional access policies and MFA on all cloud service principals
- Notify customers of potential exposure and provide incident timeline
2. Drupal Patches Critical RCE Vulnerabilities with Imminent Exploitation Risk
Severity: HIGH Affected: Technology
Drupal has released patches for two critical vulnerabilities (a reported vulnerability (identifier could not be verified against NVD and has been withdrawn) and a reported vulnerability (identifier could not be verified against NVD and has been withdrawn)) that allow remote code execution on websites running any supported version of the content management system [1]. Researchers have warned that exploits may emerge soon following patch release [1]. Both flaws affect the core CMS across all actively maintained versions.
Sources:[1] BleepingComputer
Recommended Action
- Immediately apply Drupal security patches to all instances on supported versions
- Monitor Drupal security advisories and PoC databases for exploit code
- Scan web application logs for suspicious requests to Drupal endpoints
- Consider temporary WAF rules to block known attack patterns if patching is delayed
3. Adobe Commerce BlockStrap RCE Enables Arbitrary PHP Execution
Severity: HIGH Affected: Retail
A maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce has been disclosed, potentially allowing attackers to execute arbitrary PHP code on store servers [1]. Researchers warn that hackers could exploit this flaw soon [1].
Sources:[1] BleepingComputer
Recommended Action
- Patch Adobe Commerce and Magento installations to latest security release immediately
- Review server logs for suspicious PHP execution or file uploads
- Restrict admin and developer access to production Magento instances
- Deploy Web Application Firewall rules targeting PHP code injection patterns
4. Candiru Spyware Delivered Via Malicious Ads in Zero-Click Attack
Severity: HIGH Affected: Media
Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device [1]. The attack was facilitated by an Israeli ad firm, Discover-Tech, whose ads allowed threat actors to fingerprint and track devices at scale and infect selected targets [2].
Sources:[1] BleepingComputer[2] SecurityWeek
Recommended Action
- Deploy ad blockers and script-filtering policies in enterprise browsers
- Restrict ad network domains at the network perimeter for high-risk users
- Review device inventory for indicators of Candiru infection (forensic hashes available from researchers)
- Implement network segmentation to limit lateral movement if infection occurs
5. MALFEX Campaign Distributes Malicious npm Package with Windows Shellcode Loader
Severity: MEDIUM Affected: Technology
A malicious npm package named 'imgdecode' has been discovered as part of the MALFEX supply-chain attack campaign [1]. The package, uploaded to the registry on September 30, 2026, by user 'malfexteste8', hides a shellcode loader in a Windows native addon ⚠[1].
Sources:[1] The Hacker News
Recommended Action
- Audit npm dependencies in development and production environments for 'imgdecode' and related MALFEX packages
- Review npm package provenance and publisher reputation before installation
- Implement npm namespace pinning and signed package verification in build pipelines
- Monitor for indicators of Windows shellcode execution in development and CI/CD systems
Ongoing Investigations
- BeyondTrust Zero-Day Exploitation: An alleged Chinese state-backed group is actively exploiting CVE-2026-102764, a BeyondTrust Remote Support authentication bypass, for espionage operations [24,29]. CISA added the CVE to its Known Exploited Vulnerabilities catalog with a federal remediation deadline of October 19, 2026 [31]. See earlier coverage.
- ShinyHunters Arrests Continue: A teenager from Amman, Jordan suspected of leading the prolific ShinyHunters data theft group has been detained and is cooperating with the FBI [14]. The group previously extorted a Boeing spin-off prior to arrests [14]. See earlier coverage.
Today’s Action Checklist
- ☐ URGENT: If using ConnectWise Cloud Backup, rotate all Microsoft 365 credentials and audit M365 audit logs for unauthorized access
- ☐ URGENT: Patch Drupal to latest security release (a reported vulnerability (identifier could not be verified against NVD and has been withdrawn), a reported vulnerability (identifier could not be verified against NVD and has been withdrawn)) before exploits surface
- ☐ URGENT: Patch Adobe Commerce / Magento instances against CVE-2026-103849 maximum-severity RCE
- ☐ Review npm dependencies for 'imgdecode' and MALFEX-linked packages; remove if found
- ☐ Validate that ad-blocking and script-filtering policies are in place for high-risk user segments