ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. Reports of the malicious activity began emerging on Friday, with administrators observing unauthorized access to client data in Microsoft 365 tenants due to a potential “SkyKick/CW breach.” Later on the same day, managed cybersecurity and threat detection platform Huntress confirmed the worries, saying that it had identified at least 162 compromised tenants in its environment. In a post today, Microsoft also confirmed malicious activity involving ConnectWise’s Cloud Backup service, saying it identified unauthorized authentication attempts from an IP address on October 15. ConnectWise’s cloud backup solutions provide backup and recovery services that help managed service providers (MSPs) and IT teams protect and restore customer data, such as emails and files, in cloud environments including Microsoft 365 and Google Workspace.
A cyber incident at a BAE Systems subsidiary just stopped every bankruptcy court in the US from sending notices, and the problem started a week ago. A security incident at BAE Systems Inc., the US subsidiary of British defense contractor BAE Systems, has taken the Bankruptcy Noticing Center offline since October 9. The Bankruptcy Noticing Center (BNC) is the system that federal bankruptcy courts use to send official notices. It handles court notices, messages to creditors, and deadline notifications that keep everyone involved in a case informed. “BAE Systems IT and websites that support the operations of the Bankruptcy Noticing Center (BNC) have been impacted by a cybersecurity incident.” reads the official judiciary statement. “As a result of the incident, all access to the BNC systems and websites that BAE operates on behalf of the judiciary and the related bankruptcy noticing process are unavailable at this time, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service. The incident has also halted the BNC’s production and distribution of bankruptcy notices for bankruptcy courts.” The disruption has prevented the center, which BAE operates on behalf of the federal judiciary, from generating and sending notices to creditors, courts, and attorneys in federal bankruptcy cases across the country. This is not a minor service disruption. The entire notification system used by federal bankruptcy courts across the country is down. “Several online services supporting US federal courts’ bankruptcy systems have gone offline following a cybersecurity incident involving a court contractor, the Administrative Office of the US Courts (AOC) said on Thursday.” Reuters reported. The US judiciary explained that the BNC sends bankruptcy notices for every federal bankruptcy court in the country. Affected domains include bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service. With that last one down, attorneys using the electronic filing system can’t generate the creditor mailing lists they normally need to serve documents. Courts are still accepting new case filings and electronic notifications to registered attorneys are still going out, but anything tied to the noticing pipeline itself has been dark since last Thursday. A BAE Systems spokesperson said that the company is “aware of a security incident that is isolated to the BNC system” and has taken immediate steps to address it. BAE Systems is “coordinating closely” with the courts on the response, the spokesperson said. Neither BAE nor the judiciary disclosed tachnical details of the incident, whether it was a deliberate cyber attack or a different kind of incident, or whether any data was accessed or taken. The Eastern District of Texas bankruptcy court’s own public notice adds a useful detail: BAE first told the Administrative Office about the problem late on October 9, which means the court system’s administrative leadership knew by that evening. “Late on Friday, October 9, 2026, BAE Systems, the contractor that services the Bankruptcy Noticing Center (BNC), notified the Administrative Office of a service disruption impacting BAE systems that process notices as well as the following websites: bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service website that supports CM/ECF access to address labels (the mailing matrix).” reads the notice. “Because of this disruption, the court polling and certification drop-off process that supports the delivery of electronic and paper notices has been interrupted and the BNC is unable to provide noticing services to the courts at this time.” Courts started posting disruption notices on October 13, but none of them mentioned a cybersecurity incident at that point, several framed it as a service interruption. The public acknowledgment of the word “cybersecurity” didn’t come until October 15. Summarizing, the incident started on or before October 9. The judiciary’s administrative office learned about it that day. Courts informed users of the problem on October 13, and the public announcement confirming a cybersecurity incident came on October 15. That’s six days between the contractor discovering the problem and the public announcement. During that time, bankruptcy cases across the country continued without the system that sends notices to keep courts, creditors, and lawyers informed. No one has announced when the service might be restored, suggesting the investigation is still at an early stage. This incident highlights a recurring problem: critical systems operated by contractors can fail in a single incident, disrupting services across every federal court handling a specific type of case. The public also waited nearly a week for an official statement. This is not a new pattern, but it keeps happening. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, BAE Systems)
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. According to e-commerce security firm Sansec, attacks leveraging the vulnerability, dubbed BlockStrap, have not yet been observed, but threat actors are expected to find a way to exploit it. The researchers based their assessment on identifying four potential attack paths involving CVE-2026-103849 in less than 24 hours. The flaw impacts September versions of Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3. The security firm warned that Adobe’s “priority 2” rating of this flaw does not reflect the danger and urgency in this case, despite the more complex attack path.
F5 addressed multiple vulnerabilities, including critical RCE flaws in NGINX that attackers could exploit without authentication. Security and application delivery firm F5 announced fixes for eleven security issues in NGINX. Among them, critical vulnerabilities tracked as CVE-2026-15176 and CVE-2026-93479 could be exploited without authentication via crafted HTTP requests. Under certain conditions beyond their control, an unauthenticated attacker could exploit the security flaws to trigger a buffer overflow leading to a restart. If ASLR is disabled or can be bypassed, the attacker could achieve RCE. The flaw CVE-2026-15176 (CVSS score of 9.2) is a heap-based buffer overflow vulnerability in NGINX Plus and NGINX Open Source that could allow an unauthenticated attacker to trigger a denial-of-service condition or potentially execute arbitrary code by sending crafted HTTP requests. The vulnerability occurs under specific configurations involving the alias directive and the $request_filename variable. Remote code execution may be possible if ASLR is disabled or bypassed. The flaw CVE-2026-93479 (CVSS score of 9.2) is a heap-based buffer overflow vulnerability in NGINX Plus and NGINX Open Source that could allow an unauthenticated attacker to trigger a denial-of-service condition or potentially execute arbitrary code through crafted HTTP requests. It affects specific configurations where regular-expression capture variables from the map directive are referenced before the map output variable, or where a non-cacheable variable is used in a string expression under certain conditions. Remote code execution may be possible if ASLR is disabled or bypassed. The third critical flaw fixed by the vendor, tracked as CVE-2026-97205 (CVSS score of 9.2), is a use-after-free vulnerability in NGINX ngx_http_core_module that, under certain configurations with asynchronous file I/O (AIO) enabled, may cause memory corruption or unexpected worker process termination when processing Server Side Includes (SSI) pages containing include virtual commands. A remote attacker could exploit the flaw to cause a denial-of-service (DoS) or potentially execute code, particularly when ASLR is disabled or can be bypassed. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, NGINX)
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Atlassian flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Atlassian flaw, tracked as CVE-2026-21589 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog. In early October, threat actors started exploiting CVE-2026-21589, a critical arbitrary file access flaw in Atlassian Data Center products. The vulnerability could allow attackers to access sensitive files under certain conditions. Affected products include Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye. “This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file’s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents.” reads the advisory. “In some configurations, there may be some sensitive files that make this highly severe.” Previdian telemetry has detected 15 exploitation attempts from three IP addresses in Japan and the U.S.. “Exploitation has now started to hit our honeypot network” Previdian Founder Ryan Dewhurst wrote on LinkedIn. On October 6, watchTowr Labs published a technical analysis of CVE-2026-21589 after comparing vulnerable and patched Atlassian packages. Researchers found a path traversal flaw where double-colon (::) sequences can be treated as path separators, allowing attackers to read files from the application web root. “While semicolons (;) are very common in path traversal within Java applications, along with the everyday dots (.) and slashes (/), one item stood out: the matching of double colons (::).” reads the analysis. “This is uncommon syntax for this type of vulnerability, but grepping through the codebase we came across an all too familiar sight.” In one Crowd deployment with Jira, researchers were able to read crowd.properties, which exposed application credentials. They then used those credentials to create a user and add it to the jira-administrators group. Crowd IP allowlisting can block this attack path. Exploitation attempts against its honeypot network reportedly began two hours after watchTowr published additional technical details about the vulnerability. According to watchTowr, the problem is in Atlassian’s web-resource handling. It can turn a string such as ..::..::..::..::WEB-INF::web.xml into ../../../../WEB-INF/web.xml, allowing attackers to move through directories and access files they should not be able to read. Atlassian says all versions before the listed fixed versions are affected: ProductFixed versionsBitbucket Data Center9.4.26, 10.2.8, 10.5.1Confluence Data Center9.2.26, 10.2.19Jira Service Management Data Center5.12.40, 10.3.26, 11.3.12Jira Software Data Center9.12.40, 10.3.26, 11.3.12Bamboo Data Center10.2.24, 12.1.12Crowd Data Center6.3.7, 7.0.3, 7.1.7, 7.2.4Crucible4.9.15Fisheye4.9.15 watchTowr has released a free tool on GitHub to help check if a server is vulnerable. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by October 18, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
The regulated utility company CenterPoint Energy says a data breach exposed the personal information of more than 1 million people in Texas. CenterPoint Energy is a regulated utility company used to deliver natural gas and electricity infrastructure, maintain power grids and pipelines, and restore service across parts of Texas, Indiana, Ohio, and Minnesota. The organization disclosed a data breach affecting more than 1 million people in Texas. This week, CenterPoint Energy told the Texas Attorney General’s Office that the breach affected 1,062,060 Texas residents. The company does not appear to have notified the affected individuals by letter. “More than one million Texans were affected by a CenterPoint Energy data breach that compromised sensitive personal information, according to newly published information from the Texas Attorney General’s Office.” reported the broadcast Click2Huston. “The state’s data breach database lists 1,062,060 Texans as being affected. The information involved includes customers’ names, addresses, Social Security information and driver’s-license numbers.” Days before the first disclosure, on September 12, a threat actor using the alias “4d722e4d656f77” claimed on a cybercrime forum to have extracted roughly 7.49 million customer records from CenterPoint Energy. “In September 2026, CenterPoint Energy, Inc. (the “Company”) became aware of an online post by a third party claiming to have obtained a data set containing certain of the Company’s customer information.” reads the FORM 8-K report filed with SEC.”While the investigation remains ongoing, the Company has determined that an unauthorized third party obtained personal information relating to a portion of the Company’s customers through one of the Company’s external facing systems (the “Incident”).” The hacker claimed the theft of names, phone numbers, service and billing addresses, account numbers, billing amounts, payment status, and partial Social Security numbers. He offered a 2.5 GB archive for download. The attacker warned that “next time we won’t simply pull data, we’ll start attacking the main infrastructure,” a line that reads well on a forum but should still be taken seriously by any critical infrastructure operator. The attackers claimed they stole over the records through an API they say lacked proper WAF protection, rate limiting, and authentication. They also claimed the company tried to stop the data dump only after millions of records had been extracted. “CenterPoint Energy continues to actively investigate the cybersecurity incident disclosed last month. Upon learning of the issue, CenterPoint activated our incident response procedures and engaged external cybersecurity, forensic, and legal advisors to assist with the investigation.” a spokesperson for CenterPoint said on Wednesday. “We continue to work with third-party experts to assess the scope of affected customer data to identify which customers will be provided notifications in accordance with applicable legal requirements.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, data breach)
In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision, an open LoRA adapter you can run locally. Others, like Laya, are
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. Multiple administrator reports indicate that attacks began in mid-September, roughly a month before the formal security bulletin, the GitHub advisory, and CVE publication. CVE-2026-110447 impacts richdocumentscode versions before 26.4.303 and resides in the Nextcloud app’s mechanism for starting the bundled Collabora server. The flaw affects only the optional built-in CODE server app. Standalone Collabora Online servers, Docker and RPM/DEB installations, and Nextcloud All-in-One deployments remain unaffected, according to Collabora. The attacks involve sending a malicious request to the app’s proxy.php endpoint, triggering OS command injection.
Microsoft announced that Windows Server 2022 has reached the end of mainstream support and will remain in extended support until October 2031. Microsoft unveiled Windows Server 2022 in March 2021 and made it generally available in September 2021 as a Long-Term Servicing Channel (LTSC) release with 10 years of support. "As of October 13, 2026, Windows Server 2022 has reached end of mainstream support and transitioned to extended support. The October 2026 security update is the last mainstream support update available for this version," it said. "Extended support includes security updates at no additional cost, and Windows Server 2022 will continue to receive monthly security updates through October 14, 2031." Microsoft has also extended Windows Server 2022 hotpatching until October 2027, one year after the mainstream end date of October 2026, for systems running the Datacenter: Azure Edition.
Confirm this action.
Leaving now will discard your changes.