Episode 3: ConnectWise backup credential abuse and Drupal critical patches, 18 October 2026
An attacker used a stolen ConnectWise Cloud Backup (formerly SkyKick) credential to sign in to at least 162 Microsoft 365 tenants, and ConnectWise has shut the service while customers disable the apps and hunt for planted credentials. Drupal shipped fixes for a critical remote code execution flaw in core and warned exploits may follow quickly. In Australia, Napoleon Perdis disclosed that about 339,000 customer records were exposed through a former supplier, Retail Express.
Reporting window: 24 hours to 7:00 am AEDT, Sunday 18 October 2026. Open sources only.
Headlines
ConnectWise Cloud Backup (SkyKick) credential abused against Microsoft 365 tenants: app-only sign-ins on 15 October bypassed MFA; Huntress confirms 162 tenants (173 per later reporting); in one tenant a Cloud Management app made itself Global Administrator and added secrets to other trusted apps; Microsoft calls it an active supply chain attack. Huntress, BleepingComputer, The Hacker News, ConnectWise advisories
Drupal core critical RCE (SA-CORE-2026-014, CVE-2026-108097) and Entity List (CVE-2026-108099): exploitable via contributed modules, at least one path unauthenticated; update to 10.6.19, 11.3.19 or 11.4.10 and Entity List 3.0.10, or uninstall field_ui. Drupal, BleepingComputer
CISA KEV deadlines: no new additions this window; Atlassian Data Center (CVE-2026-21589) due 18 October, BeyondTrust Remote Support (CVE-2026-102764) and Fortinet (CVE-2025-61624) due 19 October. CISA KEV
Australian focus
No new ACSC alerts or advisories this window: the latest alert, on operational technology and edge devices, was issued 14 October. ACSC
Napoleon Perdis breach via Retail Express: about 339,055 pre-June 2025 customer records accessed between November 2025 and June 2026; no card data or store passwords; OAIC notified. ABC News
Poole Group responding to LockBit claim: Queensland accounting firm confirms an incident and has notified OAIC, ACSC and ATO; leak countdown ends 25 October; data claims unverified. Banking Daily
AOMEI Backupper update tampering update: Google attributes it to new cluster UNC7017, active April to July 2026, with victims including organisations in Australia. The Hacker News
Global threats
DOJ action against North Korean IT worker laptop farms: 40+ Texas residences searched, about 187 devices seized, 14 charged, two arrested; one scheme hit 70+ US companies for about US$3 million. Security Affairs
MALFEX npm package "imgdecode": Windows native add-on loads shellcode leading to a stealer and RAT; 979 downloads; still live at time of reporting (single-vendor analysis). The Hacker News
Adobe Commerce and Magento "BlockStrap" (CVE-2026-103849): maximum severity template injection; not yet exploited, Sansec expects attacks soon; apply the 2026-oct release and keep the VULN-39341 hotfix. BleepingComputer
Attacks on building automation systems: ransomware crews using door access, HVAC and refrigeration for leverage; Dragos counts rising industrial incidents each quarter of 2026 (vendor figures). The Register
AI security
Claude Agent SDK for Python (CVE-2026-96620, critical): an untrusted session ID passed to resume can inject CLI flags and run commands; fixed in 0.2.121. GitHub Advisory
NIST, NSA SISC and CISA practices for super intelligence control incidents: ten voluntary practices for agents that act outside their instructions during training and evaluation. CISA
Fake Claude and ChatGPT lures: Any.Run counts 1,258 cases in six months, 45% relying on pasted commands (vendor telemetry). Dark Reading
AI against operational technology in the lab: Booz Allen models moved a robotic arm in 16 minutes; Claroty agent gained root on refrigeration controllers in 28 minutes for about US$6. Dark Reading
Industry
No significant M&A announced this window.
Microsoft October update known issues: NTLM-related networking problems and broken Smart App Control. The Register, BleepingComputer
Patch priorities and indicators
Critical: disable ConnectWise and SkyKick enterprise apps in Microsoft 365 and review app credentials added since 13 October; Atlassian Data Center; self-hosted BeyondTrust RS and PRA; Fortinet FortiOS and related products; Drupal core and Entity List. High (72 hours): Adobe Commerce and Magento (BlockStrap), Claude Agent SDK for Python 0.2.121, Windows developer machines that installed imgdecode. Hunt for: service principal sign-ins from 144.172.64[.]128 (AS14956); app IDs 506e08f9-6e9a-4da4-942b-a099a03644ae (Cloud Backup) and 24205314-2b89-4e07-a2a4-579e898a5640 (Cloud Management MS Teams); ConnectWise or SkyKick apps adding themselves to directory roles; user agents Python-urllib/3.12 and curl/7.88.1 alongside that IP. MALFEX: C2 104.234.65[.]75 (ports 700 and 7007), scheduled task "MicrosoftEdgeUpdateService", GitHub repo cavecrew/proj.
