A stolen ConnectWise backup credential opened Microsoft 365 tenants across its managed service provider customer base, while California confirmed that millions of student records were copied from a testing contractor and Drupal raced to get ahead of exploits for two critical flaws.
🔴 CRITICAL (1)
Stolen ConnectWise Cloud Backup credential used to sign in to Microsoft 365 tenants Confirmed
Attackers used a compromised application credential belonging to ConnectWise Cloud Backup, formerly SkyKick, to authenticate as the backup app inside customer Microsoft 365 tenants and obtain Graph tokens. Huntress has confirmed unauthorised sign-ins in more than 170 partner and customer tenants, mostly from 144.172.64.128 on 15 October, and in one tenant a ConnectWise Teams app granted itself Global Administrator and added new secrets to other privileged applications. Because the app already held broad consented permissions, MFA did not apply; ConnectWise has suspended Cloud Backup access while tenants should disable the app, revoke its tokens and review Entra service principal sign-in logs for application ID 506e08f9-6e9a-4da4-942b-a099a03644ae.
Sources BleepingComputer|The Hacker News
🟠 HIGH (6)
California student records stolen from testing contractor ETS Confirmed
The California Department of Education disclosed that an attacker used a compromised login to reach an ETS file transfer site and copied student records at various times between 22 May and 18 September 2026; ETS discovered the activity on 25 September. The files cover students enrolled in California public schools over the past three years plus some former students back to 2006, and include names, addresses, birth dates, student IDs, disability status and testing accommodations, but not Social Security numbers, financial data or parent details. Notifications began on 16 October and the state is offering two years of identity protection through Experian.
Drupal patches two critical remote code execution flaws and warns exploits may follow Confirmed
Drupal has fixed CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module, both of which can let an attacker run code on sites running supported versions of the CMS. The project says core alone cannot be exploited for the first flaw, but contributed modules or custom code can supply at least one unauthenticated path, and it expects exploits within hours or days of disclosure. Administrators should update core to 10.6.19, 11.3.19 or 11.4.10 and Entity List to 3.0.10, or uninstall field_ui where that is not possible.
Sources BleepingComputer
Rhysida offers 2.6TB of claimed Anne Arundel County data for sale Under investigation
Anne Arundel County in Maryland confirmed that intruders copied files from a limited set of government systems after suspicious activity was detected on 28 August 2026. The Rhysida gang says it took 814,500 files, including medical faxes, payroll registers, Social Security and banking data and jail intelligence records, and is selling the archive for 25 bitcoin, about 2 million dollars. The county says it is still determining who was affected and that this is a separate incident from a 2025 intrusion whose notification letters go out from 19 October.
Sources Cybernews
Florida driver and vehicle records exposed after stolen credentials used against licence systems Under investigation
Florida’s Department of Highway Safety and Motor Vehicles says a cybercriminal used compromised credentials on 4 September 2026 to reach department records, potentially exposing driver licence data, vehicle records, document images and other personal information. The agency blocked the access, reset affected credentials and is sending letters to current licence and ID card holders, with a year of identity and credit monitoring through Sontiq. It says it has no evidence that the information has been misused.
MALFEX npm campaign hides a shellcode loader in a native Windows addon Confirmed
Researchers at SafeDep found the npm package imgdecode, published on 30 September 2026 and still available, hiding a loader in a compiled Node.js addon that downloads encrypted shellcode from GitHub and injects it into a new dllhost.exe process. It is the latest step in MALFEX, a campaign running since August 2023 across five npm accounts that has shipped loaders for Overlord RAT and a Node.js stealer, with the operator replacing removed packages within two days. Developers should remove imgdecode plus cdn-img-fetch, img-to-native, native-runner, imgbundle and runhelper, and check Windows hosts for node_runtime_helper.exe.
Sources The Hacker News
Ahold Delhaize systems still down as Dutch police seek a formal report Under investigation
A cyberattack that began on the night of 11 October forced Ahold Delhaize to take IT systems offline across Albert Heijn, Etos and Gall & Gall, and the group says distribution centres are running again while its website and delivery services remain unavailable. Dutch police and prosecutors have publicly invited the company to file a formal complaint, noting that no criminal investigation is open and that the incident was reported to the national cyber security centre under the Cybersecurity Act. Ahold says it has no indication that customer or employee data was involved.
Sources DutchNews.nl|Cybernews
🟡 MEDIUM (2)
Napoleon Perdis breach affects 339,055 customer records held by a retail vendor Confirmed
The Australian cosmetics brand told customers that Retail Express, a third party that stored its customer records, was breached and that an unauthorised party had access between November 2025 and June 2026. Names, dates of birth, email addresses, phone numbers, postal addresses and purchase histories were exposed for about 339,055 customers who joined before June 2025, while card details and account passwords were not held in that system. The Office of the Australian Information Commissioner has been notified and the company warned customers about impersonation scams.
Sources ABC News (Australia)
Save-On-Foods rewards program More Rewards reports customer data breach Confirmed
More Rewards, the loyalty program for Save on Foods and other Jim Pattison grocery chains in western Canada, has told customers that their information was accessed in a breach this week. Reported data includes names, addresses and dates of birth, while the operator says passwords, card details and transaction history were not taken. Customers should expect phishing that quotes the stolen details.
Sources CTV News|Vancouver Sun
⚪ WATCH (1)
Cellebrite shows LOKI, a boot ROM exploit for older Apple chips Unconfirmed report
Cellebrite reportedly presented LOKI at the Hexacon conference, describing a boot ROM timing race that works against Apple chips from the iPod touch 2 through the iPhone 11. Because the flaw sits in mask ROM it cannot be fixed by a software update, but exploitation requires physical access and DFU mode, so the practical exposure is to seized, lost or stolen devices rather than remote attackers. The claim rests on conference coverage so far and no technical writeup has been published.
Sources Pasquale Pillitteri (blog)|International Cyber Digest (X)
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.