STORIES LAST WEEK
ConnectWise suspends cloud backups after Microsoft 365 tenant compromises
Seven application identities were disabled after attackers abused ConnectWise credentials. As of October 18, affected backup and restoration services remained unavailable. Revoking the original credentials does not remove access attackers may have established separately inside customer tenants. The Hacker News, October 18, 2026
Suspected China-linked hackers exploited BeyondTrust zero-day for persistent access
Mandiant traced attacks to late August, identifying custom webshell and tunneling tools, attempted credential harvesting and log deletion. The newly disclosed Remote Support vulnerability, CVE-2026-102764, enabled arbitrary file uploads and subsequent movement into internal systems. Google Cloud, October 15, 2026
Microsoft patches exploited Windows Shell security bypass
CVE-2026-96951 lets attackers evade Mark of the Web protections by persuading users to interact with malicious content. October updates also address publicly disclosed flaws affecting .NET Framework security enforcement and MessagePack-CSharp availability. The Hacker News, October 14, 2026
Citizen Lab links targeted ads to zero-click spyware infections
Researchers traced Candiru infections at Al Jazeera to advertising infrastructure that screened devices before delivering attacks. Simply loading an ad could trigger the chain, exposing a route into endpoints that does not depend on phishing clicks. Citizen Lab, October 15, 2026
BAE Systems incident interrupts federal bankruptcy notices
The contractor-operated Bankruptcy Noticing Center stopped generating and transmitting notices nationwide. The disruption also blocked creditor mailing-list services, demonstrating how a supplier incident can disable essential workflows across an entire court system. SecurityWeek, October 16, 2026
U.S. charges 14 over North Korean remote IT worker scheme
Prosecutors allege facilitators hosted employer-issued laptops in U.S. homes to support fraudulent remote hires. More than 70 companies were affected, with approximately $3 million generated for workers, highlighting the exposure created by compromised hiring and onboarding processes. U.S. Department of Justice, October 13, 2026
PEERSTITCH implant hides inside FortiGate logging and VPN processes
Unit 42 disclosed memory-resident malware that manipulates selected VPN sessions without opening listening ports. The investigation also uncovered theft of configurations and trust material for more than 500 managed firewalls, without confirming breaches of those customer networks. Unit 42, October 14, 2026
Docker Hub token flaw allowed publishing under another user’s identity
Account conversions reassigned personal access tokens without changing their secrets or obtaining the target owner’s approval. Attackers could use retained tokens to alter trusted container repositories. Docker fixed the flaw and reported no evidence of exploitation. Docker, October 12, 2026
French cyber agency broadens refrigeration-controller compromise alert
CERT-FR identified compromises affecting Danfoss, Copeland and Dixell controllers. Its updated guidance calls for removing public internet exposure, checking configurations and restoring remote access through protected networks, with source-IP filtering treated only as an emergency measure. CERT-FR, October 16, 2026
XBOW builds Chrome exploit chain with AI assistance in six days
XBOW said a researcher working with AI agents chained three vulnerabilities to escape Chrome for Windows’ sandbox when a page loaded. Google patched the flaws and awarded $250,000; XBOW reported approximately $40,000 in compute costs. XBOW, October 13, 2026
Anthropic tests AI replication across low-cost devices
Researchers ran a distributed model across 15 Android TV boxes and tested replication in simplified environments. The work shows how compromised IoT hardware could supply AI computing capacity, but does not demonstrate a fully autonomous worm operating in the wild. Anthropic, October 12, 2026
Help TDS uses thousands of Cloudflare Pages domains for support scams
Infoblox identified more than 20,000 domains over six months and linked the operation to Hotejka. Fake security warnings funnel users toward call centers that persuade them to install remote-access tools, creating opportunities for repeated compromise. Infoblox, October 15, 2026
More cybersecurity news
- Last week’s news roundup
- More cybersecurity news
- All articles sponsored by NetworkTigers
About NetworkTigers
NetworkTigers is the leader in the secondary market for Grade A, seller-refurbished networking equipment. Founded in January 1996 as Andover Consulting Group, the company originally built and re-architected data centers for Fortune 500 firms. Today, NetworkTigers provides consulting and network equipment to global government agencies, Fortune 2000 companies, and healthcare companies. Visit www.networktigers.com
