# Archive
Browse past daily curated stories
Monday, October 19, 2026
-
1The Hacker News generalConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
ConnectWise disabled seven application identities after unknown threat actors compromised ConnectWise Cloud Backup credentials and gained unauthorized access to Microsoft 365 tenants. The disabled identities include ConnectWise Cloud Backup (ID: 506e08f9-6e9a-4da4-942b-a099a03644ae) and six others, with the investigation ongoing. MSPs relying on ConnectWise Cloud Backup for M365 data protection should audit tenant access logs and rotate credentials immediately.
-
2The Hacker News generalHackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Threat actors abused a compromised ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 credential to breach 173 customer M365 environments in an active campaign. The attack exploits the trusted OAuth identity ConnectWise holds within customer tenants, giving attackers broad access without needing individual user credentials. This incident underscores the supply chain risk MSPs pose as a high-value pivot point into downstream customer environments.
-
3SecurityWeek generalIsraeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel
Israeli advertising firm Discover-Tech was used as a covert delivery channel for Candiru's zero-click spyware, enabling threat actors to fingerprint and track devices at scale through ad infrastructure before selectively infecting high-value targets. The technique bypasses traditional infection vectors by weaponizing legitimate ad-serving pipelines, making attribution and detection significantly harder. Security practitioners monitoring for Candiru-linked activity should add ad-network telemetry to their threat hunting scope.
-
4BleepingComputer generalHackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root
Attackers are actively exploiting an OS command injection vulnerability in JP-Secure's SiteGuard Server Edition WAF, allowing unauthenticated or low-privileged attackers to execute arbitrary commands as root on Linux or SYSTEM on Windows. The flaw affects server-side WAF deployments, meaning organizations using SiteGuard to protect web applications may themselves be the attack surface. Administrators should apply vendor patches immediately and review server logs for anomalous process execution.
-
5The Hacker News generalMALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
The MALFEX supply chain attack campaign includes a malicious npm package named 'imgdecode', uploaded on September 30, 2026, by user 'malfexteste8', which conceals a shellcode loader inside a Windows native addon. The package accumulated 979 downloads before discovery and remains available on npm as of publication. Developers using npm in Windows build pipelines should audit dependencies for 'imgdecode' and scan for native addon (.node file) anomalies.
-
6Graham Cluley generalKrybit ransomware: what you need to know
Krybit is an emerging ransomware gang notable for being hacked by a rival group and retaliating while continuing active extortion operations against victims. The group is described as fast-growing, and Fortra's analysis covers its TTPs, targeted sectors, and recommended defensive measures. Security teams should add Krybit IOCs to their threat intelligence feeds given its demonstrated resilience and escalating victim count.
-
7SecurityWeek generalUS Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars
CyberSN's 2026 Cybersecurity Jobs Report shows US cybersecurity job postings fell 26% overall, while demand for AI Security Engineers surged markedly. The divergence signals a structural shift in security hiring as organizations prioritize AI-native roles over traditional positions. Security professionals should consider upskilling in AI/ML security to remain competitive in a contracting job market.
-
8Ars Technica Security generalAnthropic gives outside AI watchdog “employee-like” access
Anthropic has granted an external AI safety watchdog 'employee-like' access to its systems and models, with the watchdog retaining the right to publish findings independently without Anthropic's approval. This represents a notable transparency commitment from a leading AI lab with direct implications for AI governance and third-party auditability standards. Security and policy practitioners tracking AI risk oversight frameworks should note this as a potential model for industry-wide external audit practices.
-
9Graham Cluley generalIrish police force has its Twitter hacked in cryptocurrency scam
Two official Twitter/X accounts belonging to Ireland's Garda Síochána (national police force) were hijacked and used to promote a cryptocurrency scam. The incident highlights the persistent risk of social media account compromise for high-profile public institutions lacking strong MFA enforcement on third-party platforms. Organizations should audit privileged social media account security, particularly for accounts with large public followings.
-
10WeLiveSecurity (ESET) threat-intelInbox flooded with sign-up messages? Email bombing explained
ESET's WeLiveSecurity explains email bombing — a technique where victims are flooded with sign-up confirmation emails to mask fraudulent activity, such as unauthorized financial transactions or account takeovers occurring simultaneously. The tactic exploits the signal-to-noise problem in overloaded inboxes and is often a precursor indicator of a more serious breach. Security teams and end users should treat sudden high-volume sign-up email floods as a potential incident trigger requiring immediate account review.