# Today's Top Stories

ConnectWise disabled seven application identities after unknown threat actors compromised ConnectWise Cloud Backup credentials and gained unauthorized access to Microsoft 365 tenants. The disabled identities include ConnectWise Cloud Backup (ID: 506e08f9-6e9a-4da4-942b-a099a03644ae) and six others, with the investigation ongoing. MSPs relying on ConnectWise Cloud Backup for M365 data protection should audit tenant access logs and rotate credentials immediately.

Threat actors abused a compromised ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 credential to breach 173 customer M365 environments in an active campaign. The attack exploits the trusted OAuth identity ConnectWise holds within customer tenants, giving attackers broad access without needing individual user credentials. This incident underscores the supply chain risk MSPs pose as a high-value pivot point into downstream customer environments.

Israeli advertising firm Discover-Tech was used as a covert delivery channel for Candiru's zero-click spyware, enabling threat actors to fingerprint and track devices at scale through ad infrastructure before selectively infecting high-value targets. The technique bypasses traditional infection vectors by weaponizing legitimate ad-serving pipelines, making attribution and detection significantly harder. Security practitioners monitoring for Candiru-linked activity should add ad-network telemetry to their threat hunting scope.

Attackers are actively exploiting an OS command injection vulnerability in JP-Secure's SiteGuard Server Edition WAF, allowing unauthenticated or low-privileged attackers to execute arbitrary commands as root on Linux or SYSTEM on Windows. The flaw affects server-side WAF deployments, meaning organizations using SiteGuard to protect web applications may themselves be the attack surface. Administrators should apply vendor patches immediately and review server logs for anomalous process execution.

The MALFEX supply chain attack campaign includes a malicious npm package named 'imgdecode', uploaded on September 30, 2026, by user 'malfexteste8', which conceals a shellcode loader inside a Windows native addon. The package accumulated 979 downloads before discovery and remains available on npm as of publication. Developers using npm in Windows build pipelines should audit dependencies for 'imgdecode' and scan for native addon (.node file) anomalies.

Krybit is an emerging ransomware gang notable for being hacked by a rival group and retaliating while continuing active extortion operations against victims. The group is described as fast-growing, and Fortra's analysis covers its TTPs, targeted sectors, and recommended defensive measures. Security teams should add Krybit IOCs to their threat intelligence feeds given its demonstrated resilience and escalating victim count.

CyberSN's 2026 Cybersecurity Jobs Report shows US cybersecurity job postings fell 26% overall, while demand for AI Security Engineers surged markedly. The divergence signals a structural shift in security hiring as organizations prioritize AI-native roles over traditional positions. Security professionals should consider upskilling in AI/ML security to remain competitive in a contracting job market.

Anthropic has granted an external AI safety watchdog 'employee-like' access to its systems and models, with the watchdog retaining the right to publish findings independently without Anthropic's approval. This represents a notable transparency commitment from a leading AI lab with direct implications for AI governance and third-party auditability standards. Security and policy practitioners tracking AI risk oversight frameworks should note this as a potential model for industry-wide external audit practices.

Two official Twitter/X accounts belonging to Ireland's Garda Síochána (national police force) were hijacked and used to promote a cryptocurrency scam. The incident highlights the persistent risk of social media account compromise for high-profile public institutions lacking strong MFA enforcement on third-party platforms. Organizations should audit privileged social media account security, particularly for accounts with large public followings.

ESET's WeLiveSecurity explains email bombing — a technique where victims are flooded with sign-up confirmation emails to mask fraudulent activity, such as unauthorized financial transactions or account takeovers occurring simultaneously. The tactic exploits the signal-to-noise problem in overloaded inboxes and is often a precursor indicator of a more serious breach. Security teams and end users should treat sudden high-volume sign-up email floods as a potential incident trigger requiring immediate account review.