ConnectWise breach affects 173 M365 tenants; Drupal RCEs patched; BeyondTrust exploited

ConnectWise Cloud Backup credential breach has compromised 173 Microsoft 365 customer tenants. Drupal released patches for two critical RCEs expected to be exploited imminently. Adobe Commerce faces max-severity RCE risk. Immediate patching and credential rotation required across all affected platforms.

ConnectWise Cloud Backup service shut down after attackers obtained Microsoft 365 application identities and breached 173 customer tenants.

Drupal released patches for two critical remote code execution vulnerabilities affecting all supported versions; researchers warn exploits may emerge soon.

Adobe Commerce / Magento BlockStrap maximum-severity flaw allows arbitrary PHP code execution on affected store servers.

MALFEX campaign distributes malicious npm package 'imgdecode' containing Windows shellcode loader.

1. ConnectWise Cloud Backup Credential Compromise Exposes 173 Microsoft 365 Tenants

Severity: HIGH Affected: Technology

Attackers obtained a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick) and used it to gain unauthorized access to customers' M365 environments [1] . ConnectWise has shut down customer access to the service after the breach was discovered [2] . Unknown threat actors abused the compromised application identity to access 173 Microsoft 365 tenants [1] . The attack represents a significant supply-chain compromise affecting MSP and cloud backup customers. Sources: [1] The Hacker News [2] BleepingComputer

All ConnectWise Cloud Backup customers must immediately rotate Microsoft 365 credentials and application identities

Review M365 audit logs for unauthorized access during the compromise window

Enable conditional access policies and MFA on all cloud service principals

Notify customers of potential exposure and provide incident timeline

2. Drupal Patches Critical RCE Vulnerabilities with Imminent Exploitation Risk

Severity: HIGH Affected: Technology

Drupal has released patches for two critical vulnerabilities (a reported vulnerability (identifier could not be verified against NVD and has been withdrawn) and a reported vulnerability (identifier could not be verified against NVD and has been withdrawn)) that allow remote code execution on websites running any supported version of the content management system [1] . Researchers have warned that exploits may emerge soon following patch release [1] . Both flaws affect the core CMS across all actively maintained versions. Sources: [1] BleepingComputer

Immediately apply Drupal security patches to all instances on supported versions

Monitor Drupal security advisories and PoC databases for exploit code

Scan web application logs for suspicious requests to Drupal endpoints

Consider temporary WAF rules to block known attack patterns if patching is delayed

3. Adobe Commerce BlockStrap RCE Enables Arbitrary PHP Execution

Severity: HIGH Affected: Retail

A maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce has been disclosed, potentially allowing attackers to execute arbitrary PHP code on store servers [1] . Researchers warn that hackers could exploit this flaw soon [1] . Sources: [1] BleepingComputer

Patch Adobe Commerce and Magento installations to latest security release immediately

Review server logs for suspicious PHP execution or file uploads

Restrict admin and developer access to production Magento instances

Deploy Web Application Firewall rules targeting PHP code injection patterns

4. Candiru Spyware Delivered Via Malicious Ads in Zero-Click Attack

Severity: HIGH Affected: Media

Deploy ad blockers and script-filtering policies in enterprise browsers

Restrict ad network domains at the network perimeter for high-risk users

Review device inventory for indicators of Candiru infection (forensic hashes available from researchers)

Implement network segmentation to limit lateral movement if infection occurs

5. MALFEX Campaign Distributes Malicious npm Package with Windows Shellcode Loader

Severity: MEDIUM Affected: Technology

A malicious npm package named 'imgdecode' has been discovered as part of the MALFEX supply-chain attack campaign [1] . The package, uploaded to the registry on September 30, 2026, by user 'malfexteste8', hides a shellcode loader in a Windows native addon ⚠ [1] . Sources: [1] The Hacker News

Audit npm dependencies in development and production environments for 'imgdecode' and related MALFEX packages

Review npm package provenance and publisher reputation before installation

Implement npm namespace pinning and signed package verification in build pipelines

Monitor for indicators of Windows shellcode execution in development and CI/CD systems

Ongoing Investigations

BeyondTrust Zero-Day Exploitation: An alleged Chinese state-backed group is actively exploiting CVE-2026-102764 , a BeyondTrust Remote Support authentication bypass, for espionage operations [24,29]. CISA added the CVE to its Known Exploited Vulnerabilities catalog with a federal remediation deadline of October 19, 2026 [31]. See earlier coverage .

ShinyHunters Arrests Continue: A teenager from Amman, Jordan suspected of leading the prolific ShinyHunters data theft group has been detained and is cooperating with the FBI [14]. The group previously extorted a Boeing spin-off prior to arrests [14]. See earlier coverage .

Today’s Action Checklist

☐ URGENT: If using ConnectWise Cloud Backup, rotate all Microsoft 365 credentials and audit M365 audit logs for unauthorized access

☐ URGENT: Patch Drupal to latest security release (a reported vulnerability (identifier could not be verified against NVD and has been withdrawn), a reported vulnerability (identifier could not be verified against NVD and has been withdrawn)) before exploits surface

☐ URGENT: Patch Adobe Commerce / Magento instances against CVE-2026-103849 maximum-severity RCE

☐ Review npm dependencies for 'imgdecode' and MALFEX-linked packages; remove if found

☐ Validate that ad-blocking and script-filtering policies are in place for high-risk user segments