Daily Cybersecurity News – October 21, 2026

What happened

Attackers obtained a highly sensitive API secret for ConnectWise Cloud Backup (formerly SkyKick) and used it to authenticate as the trusted multi-tenant application into customer Microsoft 365 environments.

Huntress observed malicious sign-in activity across nearly 1,000 Entra tenants starting around October 15, with more than 300 succeeding and 162 confirmed unauthorized. Microsoft noted Graph API reconnaissance and attempts to add backdoor credentials on service principals. ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management services while investigating.

Who is affected

ConnectWise Cloud Backup customers, primarily small- and mid-sized businesses and their MSPs that granted the app broad Microsoft 365 permissions covering Exchange Online, Teams, SharePoint, OneDrive and related Graph and Partner Center access.

Hundreds of tenants are confirmed impacted; additional compromises beyond monitored telemetry are likely.

Why it matters

This is a classic supply-chain compromise of an OAuth app identity rather than user credentials. The attacker inherited all previously consented permissions, bypassed MFA and conditional access, and could read mail, files and directories data while planting persistence.

Operators of any multi-tenant backup or management SaaS face similar blast-radius risk if a single client secret is stolen.

How it could have been prevented

Immediately review Entra ID sign-in and audit logs for the known ConnectWise application IDs and the reported malicious IPs. Revoke or rotate consents for the affected apps if your tenant shows anomalous activity, hunt for newly added credentials on service principals, and follow ConnectWise's security advisory for service restoration steps.

Terminate any unexpected sessions and monitor Microsoft Graph activity for reconnaissance patterns.

What happened

Multiple ransomware groups including Qilin (Spikey Scorpius) and Inc (Tarnished Scorpius), plus Settra operators, have been exploiting CVE-2026-0257, a critical authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portal and gateway, since at least early June.

The flaw (CVSS 9.1, in CISA KEV, EPSS 96.9%) arises because the devices rely on cookies without proper validation and integrity checks, letting unauthenticated remote attackers establish unauthorized VPN sessions and bypass MFA. Unit 42 has tracked post-exploitation that includes use of legitimate IT tools for recon and lateral movement, credential theft, and in one case pivoting to vCenter, disabling ESXi controls, and offline dumping of domain credentials from a virtual disk; some chains also abuse Veeam CVE-2023-27532.

Who is affected

Organizations running unpatched PAN-OS physical or virtual firewalls with GlobalProtect portal/gateway enabled, plus Prisma Access. Panorama and Cloud NGFW are not impacted.

Victims span healthcare, education, government, energy, finance, manufacturing and other sectors; exploitation continues against internet-exposed devices.

Why it matters

Successful exploitation looks like legitimate remote-employee VPN traffic, delaying detection until ransomware or data theft. The ease of initial access plus sophisticated follow-on tactics (virtualization-layer credential dumping that bypasses EDR) makes unpatched appliances high-value targets for ransomware affiliates and initial-access brokers.

How it could have been prevented

Upgrade all affected PAN-OS and Prisma Access deployments to fixed versions immediately. Disable authentication override cookies where not required, terminate all active GlobalProtect sessions after patching, and hunt for unexpected VPN connections (including hostnames such as kali), new admin accounts originating from VPN IPs, and the IoCs published by Unit 42 and ReliaQuest.

Patching alone does not remove access established before remediation.

What happened

Horizon3.ai released a public proof-of-concept exploit for CVE-2026-106173, a critical path-traversal vulnerability in Fortinet FortiSIEM 7.5.0 (CVSS 9.8 per NVD, not in CISA KEV, low EPSS).

An unauthenticated attacker connects to the gRPC service on TCP port 27918, abuses missing path validation and NUL-byte injection in the QueryResultReq handler's query-id parameter, and overwrites an arbitrary file. The PoC turns the write into RCE by replacing the Redis health-check script /opt/charting/redishb.sh that runs every 60 seconds via cron.

Who is affected

Deployments of FortiSIEM version 7.5.0. Version 7.6 is not affected; the fix is in 7.5.1 and later. Any internet- or network-exposed management interfaces listening on 27918 are at immediate risk once the PoC is public.

Why it matters

Unauthenticated remote code execution on a SIEM appliance gives an attacker full visibility into security logs and a privileged foothold inside the security operations environment. Public PoC dramatically raises the chance of opportunistic scanning and exploitation even though active exploitation has not yet been confirmed in KEV.

How it could have been prevented

Upgrade FortiSIEM 7.5.0 to 7.5.1 or later immediately. Restrict access to TCP port 27918 to trusted management networks only, monitor for anomalous gRPC traffic or unexpected modifications to /opt/charting/redishb.sh and related scripts, and review Fortinet advisory FG-IR-26-180 for additional guidance.

What happened

Technical details of two critical PHP vulnerabilities, publicly dubbed PHP2Shell and each rated CVSS 9.2, leaked online ahead of the coordinated disclosure and patches scheduled for 14:00 UTC on 21 October 2026.

PHP urged all users to prepare for immediate upgrades. Reports indicate the issues can lead to unauthenticated remote code execution and may affect PHP versions from 5 onward. WatchTowr confirmed the flaws are real after reproduction but withheld details; Huntress and others have seen no in-the-wild exploitation yet, while Sansec expects mass attacks within minutes of the patch release.

Who is affected

Essentially every internet-facing PHP installation still running unpatched code, including popular CMS and frameworks such as WordPress, Drupal, Laravel, Magento, Joomla and many others. Unsupported older branches may lack official fixes and require upgrades to supported lines.

Why it matters

PHP powers a huge fraction of the web. Pre-patch leakage of critical RCE details historically produces rapid mass scanning and exploitation once patches (and therefore diff-based PoCs) appear. Defenders have only hours to prepare and apply updates before opportunistic campaigns begin.

How it could have been prevented

Prepare staging and production systems now so the fixed PHP packages can be installed the moment they are published on php.net or via your distribution. Consider temporary mitigations such as disabling session.upload_progress if your application stack allows it, ensure WAF rules are updated, and plan to upgrade any end-of-life PHP versions to a supported release immediately after the patches land.

What happened

A Chinese-speaking threat actor abused the open-source AI platform Cairn, a general-purpose agent framework, to automate penetration-testing style attacks against more than 1,200 websites, successfully compromising over 100 of them including sites tied to John Deere, SharkNinja and Cummins.

NorForge researchers discovered more than 20 exposed malicious Cairn dashboards; the largest cluster ran over 1,100 attack projects focused on e-commerce and payment infrastructure. Agents received terse instructions, worked autonomously for roughly 23 hours per target, planted webshells for persistence, and cost an estimated $50 in tokens per successful breach.

Who is affected

Primarily e-commerce, payment and corporate websites in the US, Canada, Australia and Japan. Named victims include major manufacturers; many smaller sites were also hit. Any organization whose web applications were reachable and vulnerable during the September-October campaign window.

Why it matters

AI agent frameworks dramatically lower the skill and labor cost of large-scale intrusion campaigns. A single operator can now run industrial quantities of automated exploitation, validation and persistence with minimal ongoing effort, turning what used to require teams into a low-cost, high-volume business.

How it could have been prevented

Harden internet-facing web applications against common automated attack paths, monitor for unexpected webshells or new admin accounts, keep third-party and custom code patched, and treat any exposed AI agent control panels on your own infrastructure as high-risk assets that must be authenticated and firewalled.

What happened

Attackers tracked as UNC7017 repeatedly compromised AOMEI's update and promotional-notification servers between April and July 2026, briefly altering configuration files for windows of only 5-10 minutes so that AOMEI Backupper (and reportedly AnyViewer) clients downloaded and executed malware.

Confirmed short bursts occurred on May 28, July 16 and July 20. The malware installed a legitimate Radmin Server plus the SHINYROAD backdoor and, in one window, used an invisible pop-up to steal NetNTLM hashes. AOMEI has not yet identified or notified infected customers and initially struggled to find the root cause.

Who is affected

Users of AOMEI Backupper version 8.3.0 and later (the company claims over 100 million users worldwide) plus AnyViewer customers who checked for updates or promotional content during the brief tampering windows. Confirmed victims span IT, telecom and higher education across nearly a dozen countries; the true number is likely higher because of the short exposure periods.

Why it matters

Backup software runs with high privileges, sees every file, and is trusted by both users and security tools. Short-burst supply-chain tampering evades traditional point-in-time scanning and leaves almost no forensic residue on the vendor side after the original files are restored, making detection and victim notification extremely difficult.

How it could have been prevented

Hunt endpoints for the scheduled tasks RadminComponentRuntime and NitroRuntime, files under %LOCALAPPDATA%\Radmin and %LOCALAPPDATA%\Nitro Pro, and the network indicators published by Google and ManageEngine. Remove any unauthorized Radmin installations, reset credentials if NTLM theft is suspected, and treat AOMEI update traffic with heightened scrutiny until the vendor confirms full remediation and begins customer notifications.

What happened

Hobbyists and researchers are increasingly using AI coding agents and specialized tools such as the viral Reverse Engineer Anything project to decompile, reverse-engineer and reimplement firmware and software on consumer devices.

Examples include stripping ads and bloat from smart TVs, reviving bricked Lululemon mirrors, turning picture frames into calendars, and cloning proprietary algorithms from hardware such as guitar pedals, often with only a model number or binary dump as input. The same techniques that enable beneficial repairs also lower the barrier for unauthorized modification and potential abuse.

Who is affected

Owners of IoT and consumer electronics whose firmware is being modified (TVs, monitors, cameras, mirrors, appliances) as well as the original vendors whose software and hardware designs are being cloned or altered. Security teams may also see secondary risk if poorly understood AI-generated code is later installed on networked devices.

Why it matters

AI dramatically reduces the expertise and time previously required for reverse engineering. While many uses restore functionality or remove unwanted telemetry, the same workflow can produce insecure or malicious firmware, flood open-source communities with low-quality clones, and threaten business models that rely on proprietary embedded software.