Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. The company says it has isolated the issue and eradicated the immediate threat. Currently, its team is working to restore services following thorough security reviews conducted with help from CrowdStrike specialists. Bullhorn is an American software company specializing in cloud-based staffing and recruitment solutions. Its platform helps staffing firms manage the recruitment lifecycle, including candidate tracking, onboarding, and payroll. The company says it serves more than 10,000 customers worldwide. According to a status page on the incident, customers started to experience issues with job posting in the Bullhorn application on Friday. The next day, the company said it was "experiencing a system-wide outage affecting the Bullhorn platform," and later confirmed that the issues were caused by a cyberattack.
The open-source AI coding project OpenCode has notified some users that stored API keys they used with external providers were exposed in a security breach. Multiple users reported that the incident led to unauthorized API charges and suspended projects in Google Cloud. According to the project maintainer, the breach affected 1.4% of OpenCode Console users, with some reporting more than $1,700 in unauthorized charges overnight. OpenCode is a model-agnostic AI coding agent that helps users understand code, write features, and fix bugs using natural-language instructions, through a terminal, desktop app, or code editor. Users can connect AI models from multiple AI providers to the OpenCode console to streamline and automate the development process. On Saturday, OpenCode announced that it suffered a large distillation attack that impacted only developers who linked external providers, including Anthropic, OpenAI, and Google.
Microsoft has fixed a known issue that caused games and Windows 11 apps using AC-3 (Dolby Digital) audio decoding to crash after installing the September 2026 preview update (KB5124010). While KB5124010 is an optional update that requires clicking a "Download and install" link (reducing the number of potentially affected Windows users), it installs automatically on devices where the "Get the latest updates as soon as they're available" option is toggled on. "In some cases the application can fail to launch, or close without warning. In other cases the application will work normally until certain features are used, such as playing music," Microsoft said when it acknowledged this issue two weeks ago. "Affected applications may vary and can include games, media players, and certain productivity applications."
Cybercriminals are selling forged identity documents, deepfake videos, and live verification services to help buyers bypass Know Your Client (KYC) checks. Flare examines how these underground services operate and the techniques used to create and maintain fraudulent verified accounts.
Microsoft has fixed a known issue that removed the Copilot Chat and Copilot buttons in the classic Outlook desktop mail client for some Windows users. As explained in an updated support document, affected users with the Copilot Chat (Basic) license or a Microsoft 365 Copilot (Premium) account no longer saw Copilot buttons in the side navigation and above the ribbon. Those impacted by this experienced one or more of the following issues: Microsoft first announced in June that it had fixed the bug with a service change, but last month it said it had started investigating again after recent updates caused it to resurface. Now, Microsoft says it has finally resolved this classic Outlook issue, blaming it on a bug that prevented Outlook from retrieving some account information from the user's Outlook profile.
OpenBSD flaws, including a 37-year-old BSD bug, enable local attackers to bypass security protections and gain root access. Patches are available. Cybersecurity firm Calif published a full exploit and write-up this week for a local privilege escalation on OpenBSD 7.9 that chains two separate kernel flaws, one of them a 37-year-old integer overflow inherited from the original BSD sources. The exploit bypasses OpenBSD’s KARL address randomization and the SMAP and SMEP hardware protections without needing any information disclosure vulnerability at all. OpenBSD already shipped patches for both issues in September: the integer overflow fix in errata 018 on September 14, and the related use-after-free fix in errata 026 on September 30. Both are available through syspatch and cover all architectures. The shared memory attachment counter, shm_nattch, was defined as a signed 16-bit integer in BSD source code in 1988. It could hold a maximum value of 32,767. OpenBSD inherited this definition and never changed it. By mapping 127 shared memory segments and creating 259 processes through forking, an attacker can push the counter beyond its limit, causing it to wrap around to a negative value. This triggers a use-after-free vulnerability through a race condition. The corrupted counter makes the kernel free memory that other processes are still using. The second flaw builds on the first. An out-of-bounds write overwrites multicast membership counters in the kernel. When the affected socket closes, the resulting counter updates modify page table entries, allowing user memory to be accessed with supervisor-level privileges. This bypasses SMAP and SMEP protections by exploiting errors in the kernel’s internal memory accounting, rather than directly attacking the hardware. “One traced back roughly 37 years to the original BSD sources, where a shared memory attachment counter was defined as a signed 16-bit short. Repeatedly forking a process with shared memory attachment records could push that counter past its maximum value of 32,767, causing it to wrap to a negative value.” reads the Califs’ analysis. “This integer overflow could lead to a use-after-free via a race condition; combined with a separate out-of-bounds write in the kernel, it allowed local privilege escalation to root.” OpenBSD’s KARL protection relinks the kernel at boot to randomize function and data addresses, which is real and meaningful hardening. “While OpenBSD’s KARL relinks the kernel binary to randomize both function and data addresses, the kernel’s memory allocators remain deterministic. Both the boot-time allocator and the best-fit allocator lack base address randomization.” continues the analysis. “Consequently, early boot allocations consistently land at predictable locations across boots on the same hardware.” Early boot allocations, including function pointers in network interface handlers, land at the same addresses across every reboot on the same hardware. That predictability is what the exploit actually uses. It targets the lo0 and enc0 interface ioctl handlers, two structures the kernel always places at known addresses, overwriting one to gain code execution and using the other to cleanly restore the overwritten pointer afterward. No information disclosure needed, no guessing required. The researchers used kernel memory allocation metrics available through sysctl to track live allocations and detect when new pages were being created, essentially doing heap layout analysis from userland. They aligned IP socket allocations and set a multicast TTL option to a non-default value to get a persistent 16-byte structure placed where they needed it. The race condition was won by using IPC_RMID in one process while a helper process running in parallel attached a size-confused shared memory segment. Calif researchers note there’s no evidence of either flaw being exploited in the wild, and no CVE has been assigned to either issue as of publication. The report does more than explain the exploit. Calif suggests four security improvements that could make this attack much harder or prevent it entirely. First, safe-unlinking for kernel linked lists checks that data structures are valid before writing to memory. If something is wrong, the kernel stops. FreeBSD and NetBSD already use this protection, but OpenBSD does not. Second, randomizing the page table’s self-referential mapping at boot would prevent attackers from predicting which memory location to target with the decrement operation. Third, randomizing the kernel allocator’s base address at boot would make it harder to predict function pointer locations. The researchers say this protection would have almost no performance cost. Finally, enabling array bounds checks in release builds would detect this type of out-of-bounds write. Calif also reported 21 issues to FreeBSD that the same protection could have caught, including flaws that could allow local privilege escalation. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, OpenBSD)
Attackers stole ConnectWise application credentials to access Microsoft 365 tenants, prompting the company to suspend cloud services. ConnectWise suspended its Cloud Backup service and took both SaaS Security and Cloud Management offline over the weekend after discovering that unknown attackers had obtained unauthorized access to seven of its application identities. The company discovered the incident on October 14 through internal monitoring, disabled the compromised identities on October 17, and is still investigating how attackers obtained the credentials. “We have taken protective action following unauthorized access to application identities associated with ConnectWise Cloud Backup, formerly known as SkyKick. Our investigation remains ongoing. Since implementing the mitigations described below, we have not observed successful threat activity in the environments we monitor.” reads the alert published by the company on October 17. “Out of an abundance of caution, we suspended Cloud Backup service by revoking certificates used for affected application connections across all users. This removed ConnectWise’s access through those connections. The shared credentials previously used for Cloud Backup are no longer valid and cannot be used. In addition to mobilizing our internal security teams and Security Operations Center (SOC), we have engaged a reputable third-party incident response firm to support our investigation and containment efforts. Together, these teams are actively monitoring our backup infrastructure and broader environment, with the investigation extending across all partner-facing services. At this time, we have no indication that any other ConnectWise product, service, or offering is impacted.” This was not a case of attackers stealing individual customers’ passwords. ConnectWise’s applications already had permission to access customer Microsoft 365 environments to manage services and run backups. After stealing the application credentials, the attackers could pretend to be ConnectWise’s own applications and request access tokens from Microsoft Entra ID. They did not need to steal any customer passwords. Depending on the permissions granted to these applications, the attackers could access mailboxes, SharePoint documents, Teams messages, and directory data. ConnectWise explained that disabling the affected connections prevents new authentication through those connections; however, it does not reverse changes previously made inside a tenant. In other words, disabling the compromised connections stops new access through them, but it does not undo what the attackers may have already done inside customer environments. Any changes made before the connections were disabled may remain. Here’s what makes this particularly hard to clean up. An attacker who used a stolen application credential to get into a tenant could add their own client secret to a different trusted application already registered in that tenant, or create an entirely new application and grant it permissions. Either path gives them a second key that still works even after ConnectWise’s original compromised credential is revoked. “The larger risk is what happens when that access is used to gain more. If an application can assign directory roles, as we saw in one tenant, it can make itself a Global Administrator, and an administrator can add credentials to other applications, create new applications and grant them permissions, reset passwords and authentication methods for users, and change Conditional Access policies.” reads the analysis published by cybersecurity firm Huntress. “Each of those steps gives the attacker another way back in that does not depend on the original vendor credential, which is why rotating the vendor credential is necessary, but not enough.” Huntress identified malicious sign-ins from IP address 144.172.64.128 through October 15 at around 14:20 UTC, and a second targeted wave later that same day aimed specifically at 16 tenants in the policy, national security, trade, and critical minerals sectors. That second wave appeared to be manual rather than automated and hit Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and Office 365 Management APIs in rapid succession. All 16 attempts in the second wave failed, but the fact that they were manually targeted at sensitive sectors is the detail worth sitting with. Of about 1,000 Microsoft Entra tenants that recorded sign-in activity from the suspicious IP address, around 300 sign-ins were successful. However, a successful sign-in did not always give the attackers access to a tenant. In some cases, they could not proceed because the required service principal was missing. This was a result of the tenant’s configuration, not a security measure that had been deliberately put in place. ConnectWise said its Cloud Backup archives remain encrypted, isolated, and preserved, with no evidence that attackers accessed or compromised them. “Cloud Backup remains suspended. Scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable.” continues the ConnectWise’s alert.”Existing archives remain encrypted, isolated, and preserved. We have no evidence that these archives have been accessed.” However, while the service remains offline, backups cannot run and customers cannot restore their data. This creates an operational risk for organizations that depend on the service to recover their systems and information. Huntress’s recommendation for anyone using ConnectWise Cloud Backup or Cloud Management is to review both their own Microsoft 365 tenant and every managed customer tenant, including any with dormant SkyKick connections. Look specifically for sign-in activity from 144.172.64[.]128 starting October 13. Before doing anything else, preserve available sign-in and audit logs, because containment steps can overwrite the evidence you need to understand what actually happened. The list of what to check is long: application credentials and federation trusts, directory role assignments, consent grants, recent policy changes, mailbox forwarding rules, and delegated mailbox access. Any of these could be the thing an attacker quietly added before the connection was killed. Full ConnectWise advisory and ongoing updates are available here. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ConnectWise)
Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems. In a new Windows release health dashboard update over the weekend, Microsoft said users may have trouble accessing email or signing in to Outlook after installing the latest updates on systems running Windows Server 2019 and later. In some cases, affected customers are also reportedly seeing Exchange Server OWA failing with a "MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142)" error and Event ID 1006 in the application log. "After installing the October 2026 Windows security update [..], some on-premises Exchange servers might experience issues accessing or sending email. Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered. Additionally, Exchange might experience issues accessing mailboxes during mailbox replication," it said.
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site that installed and activated one of those copies should be treated as compromised, and the
The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done. This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were
Confirm this action.
Leaving now will discard your changes.