26 casos · pág. 1/2
Microsoft's October 2026 Patch Tuesday is described as the largest security update the vendor has ever released. According to Dark Reading, it includes zero-day vulnerabilities, among them defense bypass flaws and unauthenticated remote code execution (RCE) bugs. The article excerpt gives no CVE identifiers, affected product lists, exploi…
CERT-FR advisory CERTFR-2026-AVI-1314 reports multiple vulnerabilities in Microsoft Windows and related components, covered by Microsoft's October 13, 2026 security bulletins (ADV260001 and dozens of CVEs). Some of them allow remote arbitrary code execution, privilege escalation, remote denial of service, security policy bypass and compro…
CERT-FR advisory CERTFR-2026-AVI-1312 covers a large set of vulnerabilities in Microsoft Office, fixed in Microsoft's 13 October 2026 security updates. Exploitation can lead to remote arbitrary code execution, privilege escalation, security policy bypass and loss of data confidentiality. Microsoft states that CVE-2026-96951 is being activ…
Microsoft Threat Intelligence reports active exploitation of CVE-2026-73570, a command injection flaw in Zimbra Collaboration Suite that allows unauthenticated, zero-click compromise of internet-facing email servers. Attackers deployed webshells, escalated privileges, harvested authentication secrets and staged mailbox data across organiz…
Microsoft's October 2026 Patch Tuesday is a record release of roughly 1,415 new CVEs, the first four-digit volume ever, larger than any previous full year of Microsoft patches. Only one flaw is under active attack: CVE-2026-96951, a Windows Shell security feature bypass that evades Mark of the Web (MotW) protections. Two others are public…
CISA warns that threat actors are exploiting CVE-2026-104935, a zero-day authentication bypass by spoofing in Ivanti Connect Secure that allows remote, unauthenticated execution of arbitrary commands. The activity is being used for credential theft and data exfiltration. On Oct. 13, 2026, CISA added it to its Known Exploited Vulnerabiliti…
ConnectWise disclosed on October 16 that on October 15 it detected unauthorized access to application identities in its Cloud Backup (formerly SkyKick) environment. It suspended Cloud Backup, plus the integrated SaaS Security and Cloud Management services, as a precaution. As of 16:00 UTC on October 18 the services were still down, so end…
Attackers used compromised application credentials from ConnectWise Cloud Backup (formerly SkyKick) to access Microsoft 365 customer environments. Huntress researcher Jonathan Semon confirmed unauthorized sign-ins across 162 tenants as of 19:00 UTC on October 16. ConnectWise disabled application access, which interrupted backup services, …
ConnectWise disabled seven application identities on October 17, 2026 after unknown threat actors gained unauthorized access to them and used them to compromise Microsoft 365 tenants. The company detected the issue on October 14 and has suspended Cloud Backup, SaaS Security and Cloud Management while it investigates. Huntress observed alm…
Ivanti released its October 2026 security update on 13 October 2026. It fixes the actively exploited Connect Secure zero-day CVE-2026-104935, a spoofing-based authentication bypass that lets remote, unauthenticated attackers execute arbitrary commands (cert.ssi.gouv.fr, darkwebinformer.com). The flaw was discovered by Volexity, which trac…
ConnectWise took several cloud services offline, including Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management, after finding unauthorized access to application identities in the ConnectWise Cloud Backup environment. The company began investigating suspicious activity on October 15 and confirmed the unauthorized access by …
Huntress reports that a stolen vendor credential for ConnectWise Cloud Backup (formerly SkyKick) was used on October 15, 2026 to obtain Microsoft Graph tokens in customer Microsoft 365 tenants from the hosting IP 144.172.64.128. As of 19:00 UTC on October 16, Huntress had confirmed unauthorized sign-ins in 162 tenants. Later updates found…
A threat actor obtained a highly sensitive API secret for ConnectWise Cloud Backup (formerly SkyKick) and used it to sign in to customers' Microsoft 365 tenants, forcing ConnectWise to suspend its Cloud Backup, SaaS Security and Cloud Management services. Huntress saw sign-in activity from the malicious infrastructure across almost 1,000 …
ConnectWise suspended its Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management services on October 17-18 after attackers abused a compromised application credential to access customers' Microsoft 365 tenants. Huntress saw the Cloud Backup identity sign in to 162 M365 tenants between October 15 and 16. By October 17 it had f…
ConnectWise shut down its Cloud Backup service (formerly SkyKick Cloud Backup) after an attacker gained unauthorized access to application identities and used them to compromise Microsoft 365 tenants. Huntress identified at least 162 compromised tenants in its environment, and Microsoft Threat Intelligence characterized the incident as an…
GreyNoise reports that a single malicious cyber actor, tracked since 7 May 2026, is a suspected Chinese speaker working in UTC+8 and is the same as or related to Red Heron (reported by Acronis), based on the shared C2 domain, malware family, Gitea exploitation and other TTPs. The actor exploited the wp2shell WordPress chain (CVE-2026-6303…
GreyNoise reports that on 31 August 2026 a likely Russian-speaking malicious cyber actor used 45.142.193.132 and AI to develop, test and deploy exploits for PaperCut NG/MF (CVE-2026-81578 and CVE-2026-82078). Using hundreds of AI agents built on OpenAI's Codex harness, a DeepSeek model and public offensive security tools, the actor compro…
Microsoft released updates for at least 974 vulnerabilities in Windows and other software, its largest Patch Tuesday ever. The previous record was 570 fixes in July. The 2026 total now exceeds 2,600, more than double the 2020 record year (1,245), with three months still to go. Microsoft and other large vendors, including Adobe, Cisco, Goo…
An active supply chain attack is abusing a compromised credential for the ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 OAuth application, giving unknown actors access to customer tenants. Huntress confirmed unauthorized sign-ins in 173 partner/customer tenants, and Microsoft reports broad successful service principal authenti…
Eight intermediate CA certificates of the Indian certificate authority eMudhra (emSign brand), generated in April 2025, were found to have P-384 private keys so weak (integers below 256) that anyone can recover them from the public certificates and forge browser-trusted certificates for any domain. A researcher credited as Wayne reported …
