Today’s briefing covers 4 security issues reported in the last 24 hours, grouped by type: 3 actively exploited, 1 breaches and data exposure. Each entry says who is affected and what to do, with links to the original reports.
Actively exploited
Compromised ConnectWise Cloud Backup credential used to sign in to 173 Microsoft 365 tenants
Who is affected: Every organisation that has the ConnectWise Cloud Backup app consented in its Microsoft 365 tenant; confirmed unauthorised sign-ins observed in 173 partner or customer tenants.
Threat actors obtained a ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 application credential and used it from 144.172.64[.]128 on 15 October between 06:13 and 08:34 UTC to obtain Microsoft Graph tokens across tenants in sorted GUID order. With the app’s existing permissions, they could read mailboxes, OneDrive, SharePoint, Teams and directory data. In one partner tenant a separate ConnectWise app assigned itself Global Administrator rights and added credentials to other trusted applications, extending risk beyond the backup account. Huntress also observed the same IP password spraying four law firm tenants on 13 and 14 October without successful user sign-ins.
What to do: Audit any tenant using ConnectWise Cloud Backup or ConnectWise Cloud Management app (ID 24205314-2b89-4e07-a2a4-579e898a5640), check for unauthorised app consent changes and unexpected Global Administrator assignments, and review sign-in logs from 13 to 15 October.
Sources: thehackernews.com
BeyondTrust Remote Support: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability (CVE-2026-102764)
Who is affected: Organisations running BeyondTrust Remote Support. CISA added it to its Known Exploited Vulnerabilities list on 2026-10-16, which means attacks are confirmed.
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines. US federal agencies must fix it by 2026-10-19.
Sources: CISA KEV / NVD
Fortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability (CVE-2025-61624)
Who is affected: Organisations running Fortinet Multiple Products. CISA added it to its Known Exploited Vulnerabilities list on 2026-10-16, which means attacks are confirmed.
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines. US federal agencies must fix it by 2026-10-19.
Sources: CISA KEV / NVD
Breaches and data exposure
Meta says attackers stole code and personal data on about 1,500 people from GitHub repos
Who is affected: Around 1,500 people, mostly Meta employees in the United States, whose personal data ended up in compromised Meta GitHub repositories.
An outside group accessed some of Meta’s GitHub repositories using a stolen employee’s credentials; Meta detected the intrusion, cut off access and involved GitHub and law enforcement, with notifications starting 13 October. About 99% of what was taken was business data, mainly product source code, and roughly 1% was personal data that should not have been stored on GitHub and broke company policy. Meta said it has rotated secrets in the affected repositories, added controls to block user data being stored there and introduced proactive scanning, and is offering affected individuals credit monitoring and dark web monitoring while notifying regulators.
What to do: Anyone notified by Meta should activate the offered credit and dark web monitoring and remain alert for suspicious messages or identity theft attempts, even though Meta says the data was not the apparent target.
Sources: thenextweb.com