Episode 3: ConnectWise backup credential abuse and Drupal critical patches, 18 October 2026

An attacker used a stolen ConnectWise Cloud Backup (formerly SkyKick) credential to sign in to at least 162 Microsoft 365 tenants, and ConnectWise has shut the service while customers disable the apps and hunt for planted credentials. Drupal shipped fixes for a critical remote code execution flaw in core and warned exploits may follow quickly. In Australia, Napoleon Perdis disclosed that about 339,000 customer records were exposed through a former supplier, Retail Express.

Reporting window: 24 hours to 7:00 am AEDT, Sunday 18 October 2026. Open sources only.

Headlines

• ConnectWise Cloud Backup (SkyKick) credential abused against Microsoft 365 tenants: app-only sign-ins on 15 October bypassed MFA; Huntress confirms 162 tenants (173 per later reporting); in one tenant a Cloud Management app made itself Global Administrator and added secrets to other trusted apps; Microsoft calls it an active supply chain attack. Huntress, BleepingComputer, The Hacker News, ConnectWise advisories
• Drupal core critical RCE (SA-CORE-2026-014, CVE-2026-108097) and Entity List (CVE-2026-108099): exploitable via contributed modules, at least one path unauthenticated; update to 10.6.19, 11.3.19 or 11.4.10 and Entity List 3.0.10, or uninstall field_ui. Drupal, BleepingComputer
• CISA KEV deadlines: no new additions this window; Atlassian Data Center (CVE-2026-21589) due 18 October, BeyondTrust Remote Support (CVE-2026-102764) and Fortinet (CVE-2025-61624) due 19 October. CISA KEV

Australian focus

• No new ACSC alerts or advisories this window: the latest alert, on operational technology and edge devices, was issued 14 October. ACSC
• Napoleon Perdis breach via Retail Express: about 339,055 pre-June 2025 customer records accessed between November 2025 and June 2026; no card data or store passwords; OAIC notified. ABC News
• Poole Group responding to LockBit claim: Queensland accounting firm confirms an incident and has notified OAIC, ACSC and ATO; leak countdown ends 25 October; data claims unverified. Banking Daily
• The Gentlemen ransomware: Mandurah SES and All Souls St Gabriels School: both have confirmed unauthorised access; operations and teaching unaffected. Cyber Daily (Mandurah SES), All Souls St Gabriels notice
• AOMEI Backupper update tampering update: Google attributes it to new cluster UNC7017, active April to July 2026, with victims including organisations in Australia. The Hacker News

Global threats

• DOJ action against North Korean IT worker laptop farms: 40+ Texas residences searched, about 187 devices seized, 14 charged, two arrested; one scheme hit 70+ US companies for about US$3 million. Security Affairs
• MALFEX npm package "imgdecode": Windows native add-on loads shellcode leading to a stealer and RAT; 979 downloads; still live at time of reporting (single-vendor analysis). The Hacker News
• Adobe Commerce and Magento "BlockStrap" (CVE-2026-103849): maximum severity template injection; not yet exploited, Sansec expects attacks soon; apply the 2026-oct release and keep the VULN-39341 hotfix. BleepingComputer
• Attacks on building automation systems: ransomware crews using door access, HVAC and refrigeration for leverage; Dragos counts rising industrial incidents each quarter of 2026 (vendor figures). The Register

AI security

• Claude Agent SDK for Python (CVE-2026-96620, critical): an untrusted session ID passed to resume can inject CLI flags and run commands; fixed in 0.2.121. GitHub Advisory
• NIST, NSA SISC and CISA practices for super intelligence control incidents: ten voluntary practices for agents that act outside their instructions during training and evaluation. CISA
• Fake Claude and ChatGPT lures: Any.Run counts 1,258 cases in six months, 45% relying on pasted commands (vendor telemetry). Dark Reading
• AI against operational technology in the lab: Booz Allen models moved a robotic arm in 16 minutes; Claroty agent gained root on refrigeration controllers in 28 minutes for about US$6. Dark Reading

Industry

• No significant M&A announced this window.
• Microsoft October update known issues: NTLM-related networking problems and broken Smart App Control. The Register, BleepingComputer

Patch priorities and indicators

Critical: disable ConnectWise and SkyKick enterprise apps in Microsoft 365 and review app credentials added since 13 October; Atlassian Data Center; self-hosted BeyondTrust RS and PRA; Fortinet FortiOS and related products; Drupal core and Entity List. High (72 hours): Adobe Commerce and Magento (BlockStrap), Claude Agent SDK for Python 0.2.121, Windows developer machines that installed imgdecode. Hunt for: service principal sign-ins from 144.172.64[.]128 (AS14956); app IDs 506e08f9-6e9a-4da4-942b-a099a03644ae (Cloud Backup) and 24205314-2b89-4e07-a2a4-579e898a5640 (Cloud Management MS Teams); ConnectWise or SkyKick apps adding themselves to directory roles; user agents Python-urllib/3.12 and curl/7.88.1 alongside that IP. MALFEX: C2 104.234.65[.]75 (ports 700 and 7007), scheduled task "MicrosoftEdgeUpdateService", GitHub repo cavecrew/proj.

Show notes page | Follow on X (@u51cyber)