Today’s briefing covers 4 security issues reported in the last 24 hours, grouped by type: 3 actively exploited, 1 breaches and data exposure. Each entry says who is affected and what to do, with links to the original reports.<\/p>\n
Who is affected:<\/strong> Every organisation that has the ConnectWise Cloud Backup app consented in its Microsoft 365 tenant; confirmed unauthorised sign-ins observed in 173 partner or customer tenants.<\/p>\n Threat actors obtained a ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 application credential and used it from 144.172.64[.]128 on 15 October between 06:13 and 08:34 UTC to obtain Microsoft Graph tokens across tenants in sorted GUID order. With the app’s existing permissions, they could read mailboxes, OneDrive, SharePoint, Teams and directory data. In one partner tenant a separate ConnectWise app assigned itself Global Administrator rights and added credentials to other trusted applications, extending risk beyond the backup account. Huntress also observed the same IP password spraying four law firm tenants on 13 and 14 October without successful user sign-ins.<\/p>\n What to do:<\/strong> Audit any tenant using ConnectWise Cloud Backup or ConnectWise Cloud Management app (ID 24205314-2b89-4e07-a2a4-579e898a5640), check for unauthorised app consent changes and unexpected Global Administrator assignments, and review sign-in logs from 13 to 15 October.<\/p>\n Sources:<\/strong> thehackernews.com<\/a><\/p>\n Who is affected:<\/strong> Organisations running BeyondTrust Remote Support. CISA added it to its Known Exploited Vulnerabilities list on 2026-10-16, which means attacks are confirmed.<\/p>\n BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.<\/p>\n What to do:<\/strong> Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines. US federal agencies must fix it by 2026-10-19.<\/p>\n Sources:<\/strong> CISA KEV \/ NVD<\/a><\/p>\n Who is affected:<\/strong> Organisations running Fortinet Multiple Products. CISA added it to its Known Exploited Vulnerabilities list on 2026-10-16, which means attacks are confirmed.<\/p>\n FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.<\/p>\n What to do:<\/strong> Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines. US federal agencies must fix it by 2026-10-19.<\/p>\nBeyondTrust Remote Support: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability (CVE-2026-102764)<\/h3>\n
Fortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability (CVE-2025-61624)<\/h3>\n