Cyberattacks

Microsoft has tied the attack on ConnectWise’s Cloud Backup service to Storm-0940, a hacking group it describes as China-state aligned. According to Microsoft, the group used ARTEX, an open-source AI penetration-testing framework, and compromised application credentials tied to the service to try to break into more than 2 250 downstream Microsoft 365 tenants. Most attempts failed, but in multiple cases the attackers gained privileged cloud access in under three hours.

ARTEX generated up to 2 900 sign-in attempts per minute, leaving defenders little time to respond. Microsoft says the attack was part of a broader Storm-0940 campaign, active since at least September, that targeted hundreds of organizations in industries including defense, energy, aerospace, and financial services. How the attackers first obtained the credentials remains undisclosed.

ConnectWise has suspended Cloud Backup and taken its SaaS Security and Cloud Management services offline, though it says existing backup archives show no sign of compromise. The company urges customers to keep affected connections offline until further notice, and Microsoft advises reviewing every linked Microsoft 365 tenant and preserving logs before making changes.

Source: Dark Reading

Attackers are trying to exploit the critical PHP flaws dubbed php2shell at scale, two days after the PHP project shipped fixes. Cloudflare CEO Matthew Prince says the company saw thousands of exploitation attempts in the 10 hours before the flaws were announced, rising to millions since. Amazon also saw attempts, but its websites kept running normally. No successful breaches have been confirmed so far.

Under the right conditions, the flaws let an unauthenticated attacker run code on servers running PHP, which security firm Wiz says powers 70% of the world’s websites. In the UK, tech minister Baroness Lloyd told the House of Lords that 32 government services were unavailable and four partially so, largely as a precaution while updates were applied.

Orange also suspended some services globally while it deployed fixes. Researchers scanning for exposed servers say organizations are patching more slowly than hoped, and experts warn the full impact could take months to surface.

Source: BBC News

Ransomware groups are exploiting a high-severity Palo Alto Networks GlobalProtect VPN vulnerability (CVE-2026-0257, CVSS 7.8) to bypass multi-factor authentication and break into corporate networks. Palo Alto’s Unit 42 links the attacks to Qilin and Inc ransomware, in cases since early June across healthcare, finance, government, manufacturing, and other sectors. The first exploitation was seen on May 17, four days after Palo Alto released a fix.

Only portals and gateways with authentication override cookies enabled are exposed, and only when the cookie certificate is also used for a public-facing service. Attackers take the public key from that service and forge a cookie the gateway accepts in place of a full login.

In one standout case, attackers reached VMware’s vCenter management system, disabled an ESXi security control, then pulled credentials directly from a domain controller’s virtual disk — completely sidestepping endpoint detection tools running inside the VM. Unit 42 also saw attackers pair this access with tools targeting Veeam backup systems through a separate known flaw, CVE-2023-27532.

Organizations should patch all affected GlobalProtect portals and gateways immediately; users will need to sign in again once afterward. As a temporary fix, disable authentication override cookies or generate a new certificate used only for them.

Source: Cybersecurity News

An attacker copied personal data on millions of California public school students from Educational Testing Service (ETS), the state’s testing contractor. Using a stolen login, the intruder accessed an ETS file transfer site at various times between May 22 and September 18, before ETS spotted the activity on September 25.

The breach covers all students enrolled in the past three school years, and possibly more; over 5.7 million were enrolled this year alone. Records include names, birthdates, addresses, student IDs, race, disability status, and assessment results. Social Security numbers, financial data, and parent information were not involved, and ETS has found no sign the data has been published.

ETS is offering two years of free Experian identity protection, with enrollment open until March 19, 2027. Notices to families began October 16 and run through early November. State education officials are also reviewing whether ETS met its data security and contract requirements.

Source: CBS News San Francisco

A compromised API secret for ConnectWise Cloud Backup, formerly SkyKick Backup, has left hundreds of customers exposed in an ongoing supply-chain attack. The credential belongs to a multi-tenant application, so whoever holds it can request access tokens in any tenant where the app is installed, with no action by the customer and no multi-factor prompt.

Huntress dates the credential’s use to around October 14 and saw the first wave of attacks on Friday, October 16. Microsoft Threat Intelligence observed broad successful sign-ins from a malicious IP on October 15. By October 17, Huntress had seen sign-in activity across almost 1 000 Entra tenants, more than 300 of which appeared to succeed, and confirmed unauthorized sign-ins in 162 — with more likely beyond its own telemetry. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management that day.

Disabling the app may not be enough. In tenants where Huntress saw post-compromise activity, the application’s account elevated its own privileges and added credentials to other applications, which would keep access alive after the original app was switched off.

ConnectWise says it has no view into customer tenants and cannot tell whether any individual Microsoft 365 environment was accessed, so every affected tenant needs its own review. Huntress, ConnectWise, and Todyl all advise disabling ConnectWise Cloud Backup and ConnectWise Cloud Management – MS Teams in the Entra admin center even if the logs look clean. Existing backup archives remain encrypted and preserved.

Source: CyberScoop

A Chinese-speaking hacker used AI agents to break into more than 100 company websites, Reuters reports. NorForge researcher Snorre Fagerland estimates the campaign cost about $5,000 in AI tokens, roughly $50 per successful intrusion. From September 25, the agents tried to compromise more than 1 200 sites, mainly online stores in the US, Canada, Australia, and Japan.

The operator used Cairn, an open-source platform that coordinates AI agents, to work through attack chains — SQL injection, file uploads, login bypasses — with minimal hands-on effort. NorForge puts the success rate across the campaigns it observed at around 10% and found no obvious sign of state backing.

Targets included sites linked to Deere, SharkNinja, and Cummins. Deere found no sign of sensitive data being accessed, SharkNinja said the threat to a separate support site was contained, and Cummins was investigating a third-party-run site. How much data was taken, if any, remains unknown.

Source: Cybersecurity News

German police have detained Vladimir K., a 28-year-old Russian national accused of being a core member of the Qilin cybercrime gang. Japanese police arrested him in May on a German warrant over a September 2024 ransomware attack on a logistics company, and Japan handed him over to Germany on October 2. German investigators are now including the 2024 Synnovis hack in their inquiry.

Qilin hit Synnovis, a blood testing company serving several London hospitals, in June 2024. The attack disrupted more than 10 000 appointments, and the delays it caused contributed to a patient’s death — reported as the first cyberattack in history directly linked to a fatality.

Qilin has allegedly hacked nearly 4 000 organizations since 2024, extorting over $140 million. Separately, British police are examining whether their own inquiry could lead to an unlawful killing case — potentially a world first in cybercrime prosecution.

Source: BBC News

A single stolen login credential gave an unauthorized party access to sensitive records for California public school students. Educational Testing Service (ETS), which runs state testing programs including CAASPP and ELPAC, discovered the breach on September 25 — but the credential had been used at various times to copy files since May 22, with the last access on September 18.

The files came from an SFTP site ETS shared with the California Department of Education. No victim count has been given. The department says the data covers students enrolled from 2023 onward, plus anyone who left a California school since 2006 without a confirmed transfer elsewhere — and more than 5.7 million students were enrolled in 2025-2026 alone.

Stolen data includes names, birth dates, addresses, Statewide Student Identifiers, disability status and Section 504 status, testing accommodations, and test results, though not every student had every category exposed. Social Security numbers, passwords, and financial details were not in the files, and parent information wasn’t involved.

ETS disabled the account, pulled the site offline, and built a replacement. How the credential was stolen and who used it remain unknown, though ETS says its web monitoring has found no sign the data has been published. CDE and the State Board of Education are now reviewing whether ETS met its security and contractual obligations. Notification letters started going out on October 16 and continue into early November.

Source: SecurityWeek

Southville Primary School in Bristol has been hit by a targeted cyber-attack, with records exported from its management information system. Parents and carers were told on Tuesday afternoon, and the breach has been reported to the ICO. What type of information was taken hasn’t been disclosed.

Bristol City Council believes the same criminals behind September’s attack on its Schools IT network are responsible, though that is unconfirmed and Southville is being investigated separately. The two systems are not connected — school management information systems don’t sit on the Schools IT network, so Southville shouldn’t have been exposed by the earlier breach. The council, specialist cyber security experts, and the Regional Organised Crime Unit are investigating both incidents and any link between them.

That earlier attack started with suspicious activity on September 21 and led the council to disconnect 88 schools from the internet on September 25. As of Wednesday evening, 84 had limited access back, including all 39 schools the council’s IT service supports directly. The council has found no evidence of a mass data export from that network.

John Curry, reader in cyber security at Bath Spa University, called the possible connection curious and questioned why hackers appear to be targeting Bristol. Once inside one school, he said, attackers pivot to the next — using what they learn to email another school posing as a headteacher.

Source: BBC News

A critical flaw in Collabora Online – Built-in CODE Server, an optional app that runs Collabora’s document server inside Nextcloud, is being actively exploited, and admins have found web shells on compromised servers. The flaw, CVE-2026-110447 (CVSS v4 9.2, Critical), lets unauthenticated attackers run OS commands as the web server user through the app’s proxy.php file, with no account or user interaction needed.

The CVE record confirms exploitation in September and October 2026. The attack window opens only when the CODE server isn’t running — during restarts, upgrades, or crashes. Standalone Collabora servers aren’t affected.

Collabora fixed the flaw in richdocumentscode 26.4.303 on September 11. Admins should upgrade to that version or later, or remove the app entirely; disabling it alone won’t stop exploitation, and the earlier fix for CVE-2025-66208 doesn’t cover it. Servers on Nextcloud 29 or older can’t install the fix and need a Nextcloud upgrade or the app removed.

Patching won’t remove a web shell that’s already in place. Admins whose servers were exposed should check for unexpected PHP files, starting with shx*.php files in the apps/richdocumentscode folder

Source: Cyber Security News