ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. Reports of the malicious activity began emerging on Friday, with administrators observing unauthorized access to client data in Microsoft 365 tenants due to a potential “SkyKick/CW breach.” Later on the same day, managed cybersecurity and threat detection platform Huntress confirmed the worries, saying that it had identified at least 162 compromised tenants in its environment. In a post today, Microsoft also confirmed malicious activity involving ConnectWise’s Cloud Backup service, saying it identified unauthorized authentication attempts from an IP address on October 15. ConnectWise’s cloud backup solutions provide backup and recovery services that help managed service providers (MSPs) and IT teams protect and restore customer data, such as emails and files, in cloud environments including Microsoft 365 and Google Workspace.
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. The security issues impact the software core's Field UI module and the contributed Entity List module. Drupal issued an advance warning at the beginning of the week, urging administrators to apply updates promptly because attackers could develop exploits shortly after the vulnerabilities’ disclosure. “The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days,” the project's security team warned. “We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before October 14, so that you can address any other upgrade issues before the security window.”
A cyber incident at a BAE Systems subsidiary just stopped every bankruptcy court in the US from sending notices, and the problem started a week ago. A security incident at BAE Systems Inc., the US subsidiary of British defense contractor BAE Systems, has taken the Bankruptcy Noticing Center offline since October 9. The Bankruptcy Noticing Center (BNC) is the system that federal bankruptcy courts use to send official notices. It handles court notices, messages to creditors, and deadline notifications that keep everyone involved in a case informed. “BAE Systems IT and websites that support the operations of the Bankruptcy Noticing Center (BNC) have been impacted by a cybersecurity incident.” reads the official judiciary statement. “As a result of the incident, all access to the BNC systems and websites that BAE operates on behalf of the judiciary and the related bankruptcy noticing process are unavailable at this time, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service. The incident has also halted the BNC’s production and distribution of bankruptcy notices for bankruptcy courts.” The disruption has prevented the center, which BAE operates on behalf of the federal judiciary, from generating and sending notices to creditors, courts, and attorneys in federal bankruptcy cases across the country. This is not a minor service disruption. The entire notification system used by federal bankruptcy courts across the country is down. “Several online services supporting US federal courts’ bankruptcy systems have gone offline following a cybersecurity incident involving a court contractor, the Administrative Office of the US Courts (AOC) said on Thursday.” Reuters reported. The US judiciary explained that the BNC sends bankruptcy notices for every federal bankruptcy court in the country. Affected domains include bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service. With that last one down, attorneys using the electronic filing system can’t generate the creditor mailing lists they normally need to serve documents. Courts are still accepting new case filings and electronic notifications to registered attorneys are still going out, but anything tied to the noticing pipeline itself has been dark since last Thursday. A BAE Systems spokesperson said that the company is “aware of a security incident that is isolated to the BNC system” and has taken immediate steps to address it. BAE Systems is “coordinating closely” with the courts on the response, the spokesperson said. Neither BAE nor the judiciary disclosed tachnical details of the incident, whether it was a deliberate cyber attack or a different kind of incident, or whether any data was accessed or taken. The Eastern District of Texas bankruptcy court’s own public notice adds a useful detail: BAE first told the Administrative Office about the problem late on October 9, which means the court system’s administrative leadership knew by that evening. “Late on Friday, October 9, 2026, BAE Systems, the contractor that services the Bankruptcy Noticing Center (BNC), notified the Administrative Office of a service disruption impacting BAE systems that process notices as well as the following websites: bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service website that supports CM/ECF access to address labels (the mailing matrix).” reads the notice. “Because of this disruption, the court polling and certification drop-off process that supports the delivery of electronic and paper notices has been interrupted and the BNC is unable to provide noticing services to the courts at this time.” Courts started posting disruption notices on October 13, but none of them mentioned a cybersecurity incident at that point, several framed it as a service interruption. The public acknowledgment of the word “cybersecurity” didn’t come until October 15. Summarizing, the incident started on or before October 9. The judiciary’s administrative office learned about it that day. Courts informed users of the problem on October 13, and the public announcement confirming a cybersecurity incident came on October 15. That’s six days between the contractor discovering the problem and the public announcement. During that time, bankruptcy cases across the country continued without the system that sends notices to keep courts, creditors, and lawyers informed. No one has announced when the service might be restored, suggesting the investigation is still at an early stage. This incident highlights a recurring problem: critical systems operated by contractors can fail in a single incident, disrupting services across every federal court handling a specific type of case. The public also waited nearly a week for an official statement. This is not a new pattern, but it keeps happening. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, BAE Systems)
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs
Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 appeared first on Unit 42.
Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. Researchers at Citizen Labs investigating the attacks referred to this technique as AdFection, noting that their report is the first public technical confirmation of mercenary spyware delivered through targeted ads. A similar method was documented in late 2025 by Amnesty International, involving ads that infected targets with Predator spyware without them clicking anything. That infection mechanism was called Aladdin and surfaced due to a collection of marketing files and documents leaked from the Intellexa surveillance company that researchers studied and corroborated with technical details from forensic investigations.
Burger King Japan disclosed a breach exposing 11.18 million app users’ personal data after attackers accessed its membership system in early October. Burger King Japan has disclosed a data breach that exposed the personal information of approximately 11.18 million official app members. Burger King Japan, the company operating the fast-food chain in the country, said attackers accessed the system managing customer membership information between October 2 and October 7, 2026. The company disclosed the incident on October 15, after discovering the data leak two days earlier. In its official notice published on October 15, the company confirmed the unauthorized access and apologized to affected customers. The announcement doesn’t identify the attackers or explain how they gained access. BK Japan says it’s working with external security specialists to determine the cause. “We have confirmed that customer membership information from the official app has been leaked externally following unauthorized access by a third party.” reads the data breach notification. The compromised data includes membership IDs, email addresses, names in Japanese characters and kana, phone numbers, dates of birth, gender, prefecture of residence, and membership registration type. The exposed information also indicates whether a customer has a mobile ordering history and whether their email address has been verified. These details can be useful to criminals even without payment data or passwords. Attackers can use them to craft convincing phishing emails, text messages, or phone calls that refer to a customer’s real identity and relationship with Burger King. A message that includes a person’s name, phone number, and other accurate details may look far more credible than a generic scam. Burger King Japan confirmed it does not store credit card numbers and found no evidence that passwords were exposed, with no confirmed cases of fraud so far. However, these factors do not completely rule out the risk of future misuse. According to the company, unauthorized access took place from October 2 through October 7, and the leak was confirmed on October 13. BK Japan says it blocked access from the source of the unauthorized communications as soon as it became aware of the incident. The company has also introduced temporary countermeasures, established an incident response team, and reported the breach to Japan’s Personal Information Protection Commission. It says permanent security improvements, further investigation with external specialists, and email notifications to affected customers are ongoing. “At present, we have confirmed that the unauthorized access was carried out by a third party.” continues the notification. The company has not yet disclosed the precise circumstances that made the intrusion possible, and the investigation is continuing. Until more details emerge, it’s too early to draw conclusions about the initial access vector or attribute the attack to a particular threat actor. Large-scale data breaches create long-lasting risks for follow-on attacks, as criminals can use stolen details for phishing, impersonation, and highly convincing scams. BK Japan urges customers to stay vigilant against fraudulent emails, texts, and calls, warning them never to click unverified links or share sensitive credentials. The core danger is that attackers no longer need network access to cause harm; they can leverage existing stolen data to target customers directly through social engineering. “Please do not access URLs, open attachments, or enter membership information or passwords if you receive a suspicious communication.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Burger King Japan)
Employees using personal ChatGPT accounts at work can expose sensitive company data, even when their organization provides an approved Enterprise workspace. NordLayer explains how IT teams can investigate unauthorized AI use and block sensitive information before it reaches personal accounts.
Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update. Smart App Control is a Windows 11 security feature that uses Microsoft's app intelligence services and code integrity features and works alongside Microsoft Defender and SmartScreen to block potentially harmful apps or binaries. According to the company, on affected devices running Windows 11, version 24H2 and later, the Smart App Control option is grayed out and cannot be toggled. "After installing this update, some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off. On affected devices, the option to turn on Smart App Control might be grayed out," Microsoft said in an update to the KB5127648 advisory.
Confirm this action.
Leaving now will discard your changes.