You are reading a back issue. Go to the latest edition →

The week

Compromised ConnectWise Credential Hits 173 Tenants

A ConnectWise Cloud Backup credential was used to access 173 Microsoft 365 tenants; pause, rotate, and audit delegated credentials now. Multiple active exploits and supply‑chain tampering increase blast radius this week.

Composed by SitRep’s AI editors from 6 sources — The Hacker News, Mandiant Threat Intelligence, Breaches.net, Check Point Research, BleepingComputer, Tenable Blog

a compromised ConnectWise Cloud Backup credential was used to sign into 173 Microsoft 365 tenants, accessing mail, OneDrive, SharePoint, and Teams; activity observed from IP 144[.]172[.] on Oct 15 between 06:13–08:34 UTC. ConnectWise paused Cloud Backup access to contain abuse—rotate delegated credentials and audit Graph token usage immediately.

Context

This week’s incidents show adversaries abusing trusted services (delegated credentials, remote‑support appliances, and update servers) to gain broad access. Organizations using ConnectWise Cloud Backup, BeyondTrust Remote Support, AOMEI update mechanisms, or self‑hosted LLM gateways are exposed; blast radius includes tenant‑wide Microsoft 365 data, enterprise servers, and potentially millions of records.

“The through‑line: rotate delegated credentials, validate update paths, and prioritize high‑risk patches now.”

From the analysis

Analysis

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Through the week adversaries leveraged trusted integrations and actively exploited enterprise software to scale access — from delegated ConnectWise credentials to ephemeral AOMEI update tampering and active BeyondTrust exploits.

The Hacker News · Mandiant Threat Intelligence

Contrarian view

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Treating Vendor Incidents as Vendor Problems

Most security teams will treat ConnectWise/AOMEI incidents as vendor problems. That is the wrong read because delegated credentials, update channels, and third‑party integrations are attack surfaces you must rotate, monitor, and isolate immediately to prevent tenant‑wide access and downstream compromise.

The Hacker News · Mandiant Threat Intelligence

Anyone with the link reads the whole edition, free. The link says nothing about you.

Email it

The move

5 things to do today

Rotate all ConnectWise Cloud Backup credentials and revoke existing Microsoft Graph tokens; audit sign‑ins and mailbox/SharePoint/OneDrive/Teams access for Oct 15 activity from IP 144[.]172.
Patch BeyondTrust Remote Support for CVE-2026-102764 and hunt for SAWFLY and BARECLAW indicators and evidence of log deletions.
Upgrade LiteLLM installations to 1.83.9 (addresses CVE-2026-35029 and CVE-2026-59823), restrict access to POST /config/update, and monitor for unauthorized file reads.
Apply Drupal core updates (10.6.19, 11.3.19, or 11.4.10) and Entity List 3.0.10 or uninstall Field UI immediately to mitigate CVE-2026-108097 and CVE-2026-108099.
Validate AOMEI update signature checks and restrict update endpoints; monitor for short (5–10 minute) anomalous redirects or unexpected downloads indicative of CROSSROAD/SHINYROAD activity.

Also drawn on Microsoft October 2026 Patch Tuesday Addresses 1407 CVEs (Tenable Blog)

On the wire

2critical
3elevated
0moderate
0low

P0Identity

Rotate and Audit Delegated ConnectWise Credentials Immediately

A compromised ConnectWise Cloud Backup credential granted access to 173 Microsoft 365 tenants and generated Microsoft Graph tokens (observed from IP 144[.]172[.]). Rotate all ConnectWise Cloud Backup credentials, revoke existing Graph tokens, and review sign‑in logs and mailbox/SharePoint/OneDrive access for anomalous activity.

THE HACKER NEWS · Attack Involves Compromised ConnectWise Credential Accessing 173 Microsoft 365 Tenants

Copy link to “Rotate and Audit Delegated ConnectWise Credentials Immediately”

P0Ransomware/Exploit

Investigate BeyondTrust CVE-2026-102764 Exploitation Artifacts

Mandiant links ARMORY CASTLE to active exploitation of BeyondTrust Remote Support (CVE-2026-102764) using SAWFLY webshell and BARECLAW tunneler for escalation and persistence—apply vendor patches, search for SAWFLY/BARECLAW indicators, and inspect logs for deletion or tampering.

MANDIANT THREAT INTELLIGENCE · Armory Castle Exploits BeyondTrust CVE-2026-102764 Using SAWFLY

Copy link to “Investigate BeyondTrust CVE-2026-102764 Exploitation Artifacts”

P1Supply Chain

Validate AOMEI Update Paths and Monitor Short‑Window Tampering

UNC7017 performed five‑ to ten‑minute update tampering windows to redirect AOMEI update/notification files to CROSSROAD and SHINYROAD payloads—restrict update URLs, enforce cryptographic validation of update packages, and monitor update server traffic for ephemeral redirects or unusual downloads.

MANDIANT THREAT INTELLIGENCE · Ephemeral Supply Chain Tampering Targets AOMEI Update Infrastructure

Copy link to “Validate AOMEI Update Paths and Monitor Short‑Window Tampering”

P1LLM Security

Patch LiteLLM Gateways to 1.83.9 and Harden Admin Endpoints

Check Point found LiteLLM (v1.77.7) with missing RBAC on POST /config/update enabling arbitrary file reads, admin takeover, and RCE via cloud modules (CVE-2026-35029, CVE-2026-59823). Upgrade to LiteLLM 1.83.9, restrict access to management endpoints, and hunt for suspicious POST /config/update traffic and unexpected file reads.

Previously in SitRep Oct 13: LiteLLM Gateway Flaws Allow Admin Takeover and RCE; Fixes in 1.83.9 · CVE-2026-35029, CVE-2026-59823

CHECK POINT RESEARCH · LiteLLM Gateways Expose High-Severity Vulnerabilities

Copy link to “Patch LiteLLM Gateways to 1.83.9 and Harden Admin Endpoints”

P1Patch Management

Apply Drupal Core and Entity List RCE Fixes or Uninstall Field UI

Drupal released fixes for two RCEs (CVE-2026-108097, CVE-2026-108099) affecting Field UI and Entity List; deploy Drupal core 10.6.19 / 11.3.19 / 11.4.10 and Entity List 3.0.10, or remove Field UI if you cannot patch immediately to avoid imminent exploit risk.

BLEEPINGCOMPUTER · Drupal Patches Critical RCE Flaws; Exploits Likely Soon

Copy link to “Apply Drupal Core and Entity List RCE Fixes or Uninstall Field UI”

Vulnerabilities named in this edition

CVE-2026-102764 · CVE-2026-35029 · CVE-2026-59823 · CVE-2026-108097 · CVE-2026-108099 · CVE-2026-96951 · CVE-2026-70229

Known exploited

Added 10 Oct – 16 Oct9 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVE	Vendor and product	Added	Due
CVE-2025-61624	Fortinet Multiple Products	16 Oct	19 Oct
CVE-2026-102764	BeyondTrust Remote Support	16 Oct	19 Oct
CVE-2026-21589	Atlassian Multiple Products	15 Oct	18 Oct
CVE-2026-0322	Palo Alto Networks PAN-OS	14 Oct	17 Oct
CVE-2026-105133	Ahsay AhsayCBS	14 Oct	17 Oct
CVE-2026-105134	Ahsay AhsayCBS	14 Oct	17 Oct
CVE-2026-76519	Cisco Secure Email Gateway	14 Oct	17 Oct
CVE-2026-104935	Ivanti Connect Secure	13 Oct	16 Oct
CVE-2026-96951	Microsoft Windows	13 Oct	16 Oct

Source: CISA KEV catalogue, version 2026.10.21 (released 21 Oct 2026; read by SitRep 23 Oct 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

End of the Saturday, October 17, 2026 weekend edition.

Read the whole paper free, by email each morning. Get the brief →

Colophon

SitRep · Vol. 1, No. 27

Publisher: Published and funded by its independent maintainer. No advertising or sponsors.
Editors: Curator, Writer, Editor and IOC Sanitizer — four AI agents.
AI disclosure: Each edition is selected, written, edited and sanitized by four AI agents (Curator, Writer, Editor, IOC Sanitizer). The maintainer builds and oversees the pipeline; editions are not reviewed by a person before they are published.
Corrections: brief@sitrepit.com or the contact page.