WEEKLY TOP TEN: October 19, 2026, 16:00 GMT
- ConnectWise Credentials Abused in M365 Tenant Attacks
ConnectWise confirmed that a credential tied to its Cloud Backup service, formerly SkyKick, was stolen and used to access customer Microsoft 365 environments. Researchers confirmed unauthorized sign-ins in 162 tenants as of October 16 and later saw nearly 1,000 tenants with sign-in activity from the attacker’s hosting address. In at least one tenant, a related ConnectWise Cloud Management app granted itself Global Administrator and added secrets to other applications for persistence. Because the credential works wherever the app is consented, MSPs and their clients are exposed. Administrators should disable the ConnectWise and SkyKick apps without deleting them, review newly added credentials and audit service principal sign-ins from October 15. - Palo Alto PAN-OS Zero-Day Lets Attackers Gain Root
Palo Alto Networks released fixes for CVE-2026-0322, a PAN-OS management interface flaw rated 8.6 that lets authenticated attackers with network access run code as root. The company reported very limited exploitation against PA-Series and VM-Series firewalls and Panorama appliances, while Cloud NGFW and Prisma Access are unaffected. It published three attacker IP addresses and says no workarounds exist beyond restricting management access to trusted internal addresses, though Threat Prevention signatures offer limited coverage. Fixes cover PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, with 11.2.16 expected October 15. CISA added the flaw to its Known Exploited Vulnerabilities catalog with an October 17 federal deadline. - Chinese APT Exploited BeyondTrust Zero-Day Since August
A China-linked espionage group tracked as Armory Castle exploited CVE-2026-102764, a 9.3-rated flaw in BeyondTrust Remote Support, as a zero-day starting August 29, according to Mandiant and Google Threat Intelligence Group. The improper message-origin validation bug affects all versions through 26.2.3 and allows file operations on appliances. After initial access the attackers deployed the Sawfly webshell and Bareclaw tunneler, gained root, harvested credentials, deleted logs and used the built-in file transfer service to exfiltrate internal documents. BeyondTrust shipped a patch October 8 and has patched all SaaS customers, but self-hosted customers must apply BT26-05-RS manually, and versions older than 24.3.1 must upgrade first. - Microsoft Patches Record 1,413 Flaws and Windows Zero-Day
Microsoft’s October Patch Tuesday disclosed a record 1,413 CVEs, including 80 critical flaws and two zero-days. CVE-2026-96951, an 8.8-rated Windows Shell bug under active exploitation, bypasses Mark of the Web protections so downloaded files open without SmartScreen, Office Protected View or macro-block warnings. CVE-2026-108398 in the .NET Framework can evade Windows Defender Application Control but requires local access. Defenders also flagged unauthenticated critical flaws, including a 9.8-rated Outlook Reading Pane remote code execution bug, a 9.8 heap overflow in Microsoft QUIC and a SQL Server deserialization bug. Experts urge teams to prioritize exploitable risk rather than the raw count. - GitLab Warns of Maximum-Severity Code Execution Bug
GitLab warned self-managed customers to patch CVE-2026-97229 immediately. The maximum-severity integer overflow in the CI/CD Regular Expression Compiler could let an unauthenticated attacker execute arbitrary code on the GitLab server through a specially crafted regular expression in a pipeline configuration. A researcher using the handle joaxcar reported the bug through GitLab’s HackerOne program. Fixes are in Community and Enterprise Edition versions 19.2.8, 19.3.4 and 19.4.2. GitLab.com already runs the patched version, and Dedicated customers need no action. The flaw follows another maximum-severity GitLab bug last month that CISA listed as exploited. GitLab serves more than 30 million registered users. - Nextcloud Collabora Flaw Exploited to Plant Webshells
Attackers are exploiting CVE-2026-110447, a critical command injection flaw in the Collabora Online built-in CODE Server app, richdocumentscode, for Nextcloud. Administrators reported attacks dating to September 10, weeks before the October 14 advisory and CVE publication. Requests to the app’s proxy.php endpoint trigger OS command injection without authentication when the built-in server is stopped, and attackers planted PHP webshells and searched for password databases and cryptocurrency wallets. Versions before 26.4.303 are affected, while standalone Collabora servers and Nextcloud All-in-One are not. Collabora says disabling the app is not enough, so administrators must upgrade or remove it. Some users also reported ransomware use, which is unconfirmed. - BlockStrap Flaw Threatens Magento and Adobe Commerce
Sansec warned that CVE-2026-103849, a maximum-severity template injection flaw dubbed BlockStrap, affects September releases of Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3, and could let attackers execute arbitrary PHP code on store servers. No attacks have been observed yet, but researchers found four potential attack paths within 24 hours and say anyone with an AI agent can reverse-engineer the patch into working exploits. Adobe published its bulletin October 13 with a priority 2 rating that Sansec disputes, noting the earlier StyleSmuggler flaw went from hotfix to mass exploitation in three days. Stores must apply the 2026-oct release and keep the September hotfix. - Burger King Japan Breach Exposes 11 Million Records
Burger King Japan disclosed that attackers accessed the system managing member information for its official smartphone app, exposing a server holding 11.18 million customer records. Unauthorized access occurred between October 2 and October 7, and the company confirmed the leak on October 13. Exposed data includes names, dates of birth, gender, email addresses, phone numbers and order history. The company says payment card numbers were not stored on the server and it found no evidence that credentials were accessed. It blocked the source of the access, reported the breach to Japan’s Personal Information Protection Commission and warned customers about impersonation emails, text messages and phone calls. - CenterPoint Energy Breach Affects 1 Million Texans
CenterPoint Energy told the Texas Attorney General that a data breach affected 1,062,060 Texas residents, exposing names, addresses, Social Security information and driver’s license numbers. The regulated utility, which delivers electricity and natural gas in Texas, Indiana, Ohio and Minnesota, said in an SEC filing that an unauthorized party obtained customer data through an external-facing system. On September 12, a forum user claimed to have taken about 7.49 million customer records through an API that allegedly lacked authentication and rate limiting, and warned of future attacks on infrastructure. CenterPoint says its investigation continues and it is still determining which customers will receive notification. - Targeted Ads Delivered Candiru Spyware to Al Jazeera
Citizen Lab and Confiant found that targeted online advertisements delivered Candiru spyware to at least 45 Al Jazeera devices during 2024 and 2025 without any user clicks. Israeli ad company Discover-Tech ran a platform that let customers enter a target’s IP address or mobile advertising ID and keep bidding until an ad reached that device, which could then be redirected to Candiru servers. Researchers recovered nearly four billion bidding records showing ads on more than 120,000 websites, and ads were recorded on networks tied to NATO, the United Nations and the European Parliament. Google, IAB Europe, Beeswax and Eskimi have cut Discover-Tech’s access. Blocking ads at gateways reduces exposure.
Our Threat Operations and Intelligence team compiles a daily digest of the most recent online cybersecurity risks. The previous 10 stories were determined to be most significant during the course of the week, ranked by highest risk, and using multiple sources when available.