You are reading a back issue. Go to the latest edition →

The situation

ConnectWise Cloud Backup Suspension After Credential Abuse

Credential abuse disrupted Cloud Backup/SaaS; verify backups, rotate credentials, and monitor for advanced access now.

Composed by SitRep’s AI editors from 6 sources — Help Net Security, Malwarebytes Labs, BleepingComputer, Unit 42, SecurityWeek, The Hacker News

ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management after attackers used a compromised credential tied to the Cloud Backup app (SkyKick) to access Microsoft 365. Huntress observed unauthorized access to at least 162 tenants, roughly 1,000 accounts targeted and 300+ successful sign-ins, and ConnectWise took services offline while investigating.

Context

Third-party trust failures—stolen credentials, hijacked update channels, and poisoned plugins—are producing immediate operational outages and data exposure across SaaS and on-prem environments. Customers using managed backup, agent-based tooling, or popular CMS/plugins are exposed; the likely blast radius includes tenant backups, API keys, automation identities, and internet-facing web apps.

“Defenders must validate backups, prioritize specific CVE patches, and rotate/revoke exposed credentials now.”

From the analysis

Analysis

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Through-line: breakdowns in third-party trust are driving immediate operational impact—vendor credential compromise, hijacked update infrastructure, and poisoned plugins are enabling access and persistence.

Help Net Security · Unit 42 · BleepingComputer

Contrarian view

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Treat Vendor Outage as Customer Incident

Most customers will treat vendor suspensions as an operational problem to be managed by the vendor. That is the wrong read because compromised vendor credentials and update infrastructure can create tenant‑level exposure and persistent access; affected customers must validate backups, rotate credentials, and hunt for lateral activity immediately.

Help Net Security · Malwarebytes Labs

Anyone with the link reads the whole edition, free. The link says nothing about you.

Email it

The move

5 things to do today

Rotate and revoke SkyKick and Cloud Backup OAuth/App credentials now; assume 300+ sign‑ins indicate successful token theft (ConnectWise incident).
Patch PAN‑OS to remediate CVE-2026-0257 immediately and hunt VPN gateway logs for unexpected sessions and post‑auth activity.
Update Drupal core to 11.4.10/11.3.19/10.6.19 and Entity List to 3.0.10 to close CVE-2026-108099 and CVE-2026-108097 on internet‑facing sites.
Apply F5/NGINX out‑of‑band patches or vendor mitigations for CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479 and inventory NGINX exposures.
Restore compromised WordPress sites from clean backups, update Rank Math PRO to v3.0.124, and rotate site API keys and admin credentials; scan for backdoors and persistence linked to rank1cdn[.]com.

Also drawn on GhostAction Targets GitHub Repos With Font-Disguised Credential Stealer (The Hacker News)

On the wire

2critical
3elevated
0moderate
0low

P0News

ConnectWise Suspends Cloud Backup and SaaS Services After Credential Abuse

ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management after attackers used a compromised SkyKick app credential to access Microsoft 365; at least 162 tenants were accessed and 300+ sign-ins succeeded. Validate backup integrity, rotate all app and automation credentials tied to Cloud Backup/SkyKick, revoke exposed OAuth tokens, and treat this as an incident for your org even if the vendor is remediating.

HELP NET SECURITY · ConnectWise Cloud Backup Suspended After Microsoft 365 Abuse

Copy link to “ConnectWise Suspends Cloud Backup and SaaS Services After Credential Abuse”

P0Intelligence

Active Exploitation of PAN‑OS CVE‑2026‑0257 Enabling VPN Access

Unit 42 reports active exploitation of PAN‑OS CVE‑2026‑0257 (authentication bypass in GlobalProtect gateway/portal) by ransomware groups, enabling external VPN access. Patch PAN‑OS immediately, monitor VPN gateway logs for anomalous authentications and unknown sessions, and hunt for post‑auth persistence and lateral movement linked to compromised gateways.

UNIT 42 · Active Exploitation of PAN-OS CVE-2026-0257 by Ransomware

Copy link to “Active Exploitation of PAN‑OS CVE‑2026‑0257 Enabling VPN Access”

P1News

Rank Math PRO supply‑chain Compromise Backdoors WordPress Sites

Rank Math PRO updates between Oct 15–16 delivered a backdoor that created persistent access and exposed credentials via rank1cdn[.]com; Rank Math PRO v3.0.124 is the clean release. Restore affected sites from clean backups, update to v3.0.124, rotate website API keys and admin credentials, and scan for webshells or unusual scheduled tasks.

BLEEPINGCOMPUTER · Rank Math Pro Supply-Chain Attack Backdoored WordPress Sites

Copy link to “Rank Math PRO supply‑chain Compromise Backdoors WordPress Sites”

P1News

Drupal Issues Emergency Patches for Critical Core Rces

Drupal released updates addressing two critical RCEs (CVE-2026-108099, CVE-2026-108097) and additional XSS fixes; some exploit chains require contributed modules. Prioritize applying Drupal core updates (11.4.10, 11.3.19, or 10.6.19) and Entity List 3.0.10, and hunt internet-facing Drupal sites for signs of exploitation.

Previously in SitRep Weekend edition, Oct 17: Apply Drupal Core and Entity List RCE Fixes or Uninstall Field UI · CVE-2026-108099, CVE-2026-108097

SECURITYWEEK · Drupal Patches Critical Core RCE Flaw, Adds Multiple CVEs

Copy link to “Drupal Issues Emergency Patches for Critical Core Rces”

P1News

F5 Issues Out-of-band NGINX Patches for Multiple Critical Rces

F5 released out‑of‑band patches for critical NGINX vulnerabilities (CVE-2026-15176, CVE-2026-97205, CVE-2026-93479) affecting NGINX Plus, Open Source, Ingress Controller, Gateway Fabric and Instance Manager. Apply F5/NGINX patches or mitigations, inventory NGINX exposures, and monitor web server logs for anomalous requests that could indicate exploitation attempts.

Previously in SitRep Oct 16: F5 and Juniper Release Patches for Multiple Critical Rces · CVE-2026-15176, CVE-2026-97205, CVE-2026-93479

BLEEPINGCOMPUTER · F5 Patches NGINX With Out-of-Band Fixes for Critical RCE

Copy link to “F5 Issues Out-of-band NGINX Patches for Multiple Critical Rces”

Indicators named in this edition

Vulnerabilities named CVE-2026-0257 · CVE-2026-108099 · CVE-2026-108097 · CVE-2026-15176 · CVE-2026-97205 · CVE-2026-93479

Kind	Value	Note
DOMAIN	rank1cdn[.]com	Used to deliver backdoor in Rank Math PRO compromise
DOMAIN	my-github[.]com	Phishing domain used in GhostAction campaign to harvest OAuth tokens

Elsewhere in the edition

OpenCode Breach Exposes API Keys During AI Distillation Attacks

OpenCode says a large distillation attack exposed API keys for 1.4% of OpenCode Console users, causing unauthorized charges up to $1,700. Exposure earliest Oct 17, 2026 00:30 UTC. Attack lasted 48 hours, targeting systems via external providers (Anthropic, OpenAI, Google).

3 reports

BLEEPINGCOMPUTEROpenCode Breach Exposes API Keys During AI Distillation Attacks
THE HACKER NEWSOpenCode Console Breach Exposes OpenAI, Anthropic, and Google API Keys
NEWSAPI CYBER INSIGHTSOpenCode Breach Exposes API Keys for OpenAI Anthropic Google

One Compromised Login Exposed Millions of California Students’ Records

Intruders used a compromised ETS login to access an SFTP site and copy California student records dating back to 2006. More than 5.7 million students enrolled in 2025-2026 were potentially affected; data included names, birth dates, addresses, IDs, and demographic details, but not Social Security numbers or financial data.

3 reports

SECURITYWEEKOne Compromised Login Exposed Millions of California Students’ Records
MALWAREBYTES LABSMillions Of California Students' Data Stolen In ETS Breach
NEWSAPI CYBER INSIGHTSMillions Of California Students’ Sensitive Data Stolen In Breach

Forget Viruses: 62% Of Americans Think AI-Fueled Scams Are The Bigger Threat

A survey of 1,000 US adults (Sept 9–12, 2026) found 62% agree AI-powered scams are more dangerous than traditional malware. The top online fears relate to scams, with over 80% receiving scam calls or emails weekly and 76% facing scam texts. Industry experts from McAfee, Malwarebytes, Bitdefender, and Norton say AI fuels more convincing fraud.

3 reports

NEWSAPI CYBER INSIGHTSForget Viruses: 62% Of Americans Think AI-Fueled Scams Are The Bigger Threat
NEWSAPI CYBER INSIGHTSScam Fatigue Is Real: 80% Of Americans Get Fake Messages Weekly
NEWSAPI CYBER INSIGHTSScam Fatigue Survey Finds 80% Face Weekly Fake Messages

Plex2Shell Flaws Exploited to Install Crypto Miners and Linux Backdoor

Attackers chain four Plex Media Server flaws (Plex2Shell) to achieve unauthenticated remote code execution, deploying an XMRig miner and a Linux reverse-proxy backdoor. Exploitation ties to CVE-2026-96652, -96654, -96655, -96656; Plex patched in 1.43.3.10861 (Aug 3, 2026). Active exploits observed Oct 2026, with miner and proxy artifacts such as mylovelyminer and myawesomeproxy.

2 reports

THE HACKER NEWSPlex2Shell Flaws Exploited to Install Crypto Miners and Linux Backdoor
SECURITYWEEKPlex2Shell Exploit Chain Weaponized Against Plex Media Servers

Also reported

BLEEPINGCOMPUTERNikkei Reports Third Data Breach in a Month Exposing 1.83 Million
BLEEPINGCOMPUTERBullhorn Platform Offline Amid Cyberattack, Investigation Underway
SECURITYWEEKSiemens Software Center Vulnerability Exploited in ClickFix Attacks
BLEEPINGCOMPUTERMicrosoft Fixes Game and App Crashes From Windows Update
CHECK POINT RESEARCHCheck Point Threat Intelligence Update for October 19, 2026
THE HACKER NEWSWeekly Recap: 98 Zero-Days, Rogue AI Agents, 700 Supermarkets Hit
BLEEPINGCOMPUTERUnderground Market for Know Your Client Services Explored
TENABLE BLOGUnmasking AI Agents With Microsoft Entra Agent ID and Tenable
MICROSOFT SECUREAgents as Insider Risk: Securing Agentic Systems
BLEEPINGCOMPUTERMicrosoft Fixes Classic Outlook Bug Hiding Copilot Buttons

End of the Monday, October 19, 2026 edition.

Read the whole paper free, by email each morning. Get the brief →

Colophon

SitRep · Vol. 1, No. 28

Publisher: Published and funded by its independent maintainer. No advertising or sponsors.
Editors: Curator, Writer, Editor and IOC Sanitizer — four AI agents.
AI disclosure: Each edition is selected, written, edited and sanitized by four AI agents (Curator, Writer, Editor, IOC Sanitizer). The maintainer builds and oversees the pipeline; editions are not reviewed by a person before they are published.
Corrections: brief@sitrepit.com or the contact page.