The situation

ConnectWise Cloud Backup Credential Abuse Incident

Credential abuse disrupted Cloud Backup/SaaS; verify backups, rotate credentials, and monitor for advanced access now.

Composed by SitRep’s AI editors from 5 sources — Help Net Security, Malwarebytes Labs, BleepingComputer, Unit 42, SecurityWeek

ConnectWise Cloud Backup Suspension After Credential Abuse

ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management after attackers used a compromised credential tied to the Cloud Backup app (SkyKick) to access Microsoft 365. Huntress observed unauthorized access to at least 162 tenants, roughly 1,000 accounts targeted and 300+ successful sign-ins, and ConnectWise took services offline while investigating.

Context

Third-party trust failures—stolen credentials, hijacked update channels, and poisoned plugins—are producing immediate operational outages and data exposure across SaaS and on-prem environments. Customers using managed backup, agent-based tooling, or popular CMS/plugins are exposed; the likely blast radius includes tenant backups, API keys, automation identities, and internet-facing web apps.

“Defenders must validate backups, prioritize specific CVE patches, and rotate/revoke exposed credentials now.”

The read

Through-line: breakdowns in third-party trust are driving immediate operational impact—vendor credential compromise, hijacked update infrastructure, and poisoned plugins are enabling access and persistence.

Help Net Security · Unit 42 · BleepingComputer

What most will miss

Treat Vendor Outage as Customer Incident

Most customers will treat vendor suspensions as an operational problem to be managed by the vendor. That is the wrong read because compromised vendor credentials and update infrastructure can create tenant‑level exposure and persistent access; affected customers must validate backups, rotate credentials, and hunt for lateral activity immediately.

Help Net Security · Malwarebytes Labs

The move

5 things to do today

Rotate and revoke SkyKick and Cloud Backup OAuth/App credentials now; assume 300+ sign‑ins indicate successful token theft (ConnectWise incident).
Patch PAN‑OS to remediate CVE-2026-0257 immediately and hunt VPN gateway logs for unexpected sessions and post‑auth activity.
Update Drupal core to 11.4.10/11.3.19/10.6.19 and Entity List to 3.0.10 to close CVE-2026-108099 and CVE-2026-108097 on internet‑facing sites.
Apply F5/NGINX out‑of‑band patches or vendor mitigations for CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479 and inventory NGINX exposures.
Restore compromised WordPress sites from clean backups, update Rank Math PRO to v3.0.124, and rotate site API keys and admin credentials; scan for backdoors and persistence linked to rank1cdn[.]com.

On the wire

P0News

ConnectWise Suspends Cloud Backup and SaaS Services After Credential Abuse

ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management after attackers used a compromised SkyKick app credential to access Microsoft 365; at least 162 tenants were accessed and 300+ sign-ins succeeded. Validate backup integrity, rotate all app and automation credentials tied to Cloud Backup/SkyKick, revoke exposed OAuth tokens, and treat this as an incident for your org even if the vendor is remediating.

HELP NET SECURITY · ConnectWise Cloud Backup Suspended After Microsoft 365 Abuse

P0Intelligence

Active Exploitation of PAN‑OS CVE‑2026‑0257 Enabling VPN Access

Unit 42 reports active exploitation of PAN‑OS CVE‑2026‑0257 (authentication bypass in GlobalProtect gateway/portal) by ransomware groups, enabling external VPN access. Patch PAN‑OS immediately, monitor VPN gateway logs for anomalous authentications and unknown sessions, and hunt for post‑auth persistence and lateral movement linked to compromised gateways.

UNIT 42 · Active Exploitation of PAN-OS CVE-2026-0257 by Ransomware

P1News

Rank Math PRO supply‑chain Compromise Backdoors WordPress Sites

Rank Math PRO updates between Oct 15–16 delivered a backdoor that created persistent access and exposed credentials via rank1cdn[.]com; Rank Math PRO v3.0.124 is the clean release. Restore affected sites from clean backups, update to v3.0.124, rotate website API keys and admin credentials, and scan for webshells or unusual scheduled tasks.

BLEEPINGCOMPUTER · Rank Math Pro Supply-Chain Attack Backdoored WordPress Sites

P1News

Drupal Issues Emergency Patches for Critical Core Rces

Drupal released updates addressing two critical RCEs (CVE-2026-108099, CVE-2026-108097) and additional XSS fixes; some exploit chains require contributed modules. Prioritize applying Drupal core updates (11.4.10, 11.3.19, or 10.6.19) and Entity List 3.0.10, and hunt internet-facing Drupal sites for signs of exploitation.

SECURITYWEEK · Drupal Patches Critical Core RCE Flaw, Adds Multiple CVEs

P1News

F5 Issues Out-of-band NGINX Patches for Multiple Critical Rces

F5 released out‑of‑band patches for critical NGINX vulnerabilities (CVE-2026-15176, CVE-2026-97205, CVE-2026-93479) affecting NGINX Plus, Open Source, Ingress Controller, Gateway Fabric and Instance Manager. Apply F5/NGINX patches or mitigations, inventory NGINX exposures, and monitor web server logs for anomalous requests that could indicate exploitation attempts.

BLEEPINGCOMPUTER · F5 Patches NGINX With Out-of-Band Fixes for Critical RCE

Indicators named in this edition

Kind	Value	Note
CVE	CVE-2026-0257	PAN-OS GlobalProtect authentication bypass under active exploitation
CVE	CVE-2026-108099	Drupal Entity List critical RCE
CVE	CVE-2026-108097	Drupal Field UI critical RCE
CVE	CVE-2026-15176	NGINX critical RCE patched by F5
CVE	CVE-2026-97205	NGINX critical RCE patched by F5
CVE	CVE-2026-93479	NGINX critical RCE patched by F5
DOMAIN	rank1cdn[.]com	Used to deliver backdoor in Rank Math PRO compromise
DOMAIN	my-github[.]com	Phishing domain used in GhostAction campaign to harvest OAuth tokens

Elsewhere in the edition

One Compromised Login Exposed Millions of California Students’ Records

Intruders used a compromised ETS login to access an SFTP site and copy California student records dating back to 2006. More than 5.7 million students enrolled in 2025-2026 were potentially affected; data included names, birth dates, addresses, IDs, and demographic details, but not Social Security numbers or financial data. ETS shut the account, replaced the site, and with law enforcement investig…

3 reports

SECURITYWEEKOne Compromised Login Exposed Millions of California Students’ Records
MALWAREBYTES LABSMillions Of California Students' Data Stolen In ETS Breach
NEWSAPI CYBER INSIGHTSMillions Of California Students’ Sensitive Data Stolen In Breach

Forget Viruses: 62% Of Americans Think AI-Fueled Scams Are The Bigger Threat

A survey of 1,000 US adults (Sept 9–12, 2026) found 62% agree AI-powered scams are more dangerous than traditional malware. The top online fears relate to scams, with over 80% receiving scam calls or emails weekly and 76% facing scam texts. Industry experts from McAfee, Malwarebytes, Bitdefender, and Norton say AI fuels more convincing fraud. Global scam losses cited: $442B, $21B in the US in 202…

3 reports

NEWSAPI CYBER INSIGHTSForget Viruses: 62% Of Americans Think AI-Fueled Scams Are The Bigger Threat
NEWSAPI CYBER INSIGHTSScam Fatigue Is Real: 80% Of Americans Get Fake Messages Weekly
NEWSAPI CYBER INSIGHTSScam Fatigue Survey Finds 80% Face Weekly Fake Messages

Plex2Shell Flaws Exploited to Install Crypto Miners and Linux Backdoor

Attackers chain four Plex Media Server flaws (Plex2Shell) to achieve unauthenticated remote code execution, deploying an XMRig miner and a Linux reverse-proxy backdoor. Exploitation ties to CVE-2026-96652, -96654, -96655, -96656; Plex patched in 1.43.3.10861 (Aug 3, 2026). Active exploits observed Oct 2026, with miner and proxy artifacts such as mylovelyminer and myawesomeproxy.

2 reports

THE HACKER NEWSPlex2Shell Flaws Exploited to Install Crypto Miners and Linux Backdoor
SECURITYWEEKPlex2Shell Exploit Chain Weaponized Against Plex Media Servers

OpenCode Breach Exposes API Keys During AI Distillation Attacks

OpenCode says a large distillation attack exposed API keys for 1.4% of OpenCode Console users, causing unauthorized charges up to $1,700. Exposure earliest Oct 17, 2026 00:30 UTC. Attack lasted 48 hours, targeting systems via external providers (Anthropic, OpenAI, Google). OpenCode used Daybreak AI for defense; some users reported hijacked projects, but OpenCode says no data appears exposed and i…

2 reports

BLEEPINGCOMPUTEROpenCode Breach Exposes API Keys During AI Distillation Attacks
THE HACKER NEWSOpenCode Console Breach Exposes OpenAI, Anthropic, and Google API Keys

Also reported

BLEEPINGCOMPUTERNikkei Reports Third Data Breach in a Month Exposing 1.83 Million
BLEEPINGCOMPUTERBullhorn Platform Offline Amid Cyberattack, Investigation Underway
SECURITYWEEKSiemens Software Center Vulnerability Exploited in ClickFix Attacks
BLEEPINGCOMPUTERMicrosoft Fixes Game and App Crashes From Windows Update
CHECK POINT RESEARCHCheck Point Threat Intelligence Update for October 19, 2026
THE HACKER NEWSWeekly Recap: 98 Zero-Days, Rogue AI Agents, 700 Supermarkets Hit
BLEEPINGCOMPUTERUnderground Market for Know Your Client Services Explored
TENABLE BLOGUnmasking AI Agents With Microsoft Entra Agent ID and Tenable
THE HACKER NEWSGhostAction Targets GitHub Repos With Font-Disguised Credential Stealer
MICROSOFT SECUREAgents as Insider Risk: Securing Agentic Systems

End of the Monday, October 19, 2026 edition.