Vulnerabilities

Microsoft has tied the attack on ConnectWise’s Cloud Backup service to Storm-0940, a hacking group it describes as China-state aligned. According to Microsoft, the group used ARTEX, an open-source AI penetration-testing framework, and compromised application credentials tied to the service to try to break into more than 2 250 downstream Microsoft 365 tenants. Most attempts failed, but in multiple cases the attackers gained privileged cloud access in under three hours.

ARTEX generated up to 2 900 sign-in attempts per minute, leaving defenders little time to respond. Microsoft says the attack was part of a broader Storm-0940 campaign, active since at least September, that targeted hundreds of organizations in industries including defense, energy, aerospace, and financial services. How the attackers first obtained the credentials remains undisclosed.

ConnectWise has suspended Cloud Backup and taken its SaaS Security and Cloud Management services offline, though it says existing backup archives show no sign of compromise. The company urges customers to keep affected connections offline until further notice, and Microsoft advises reviewing every linked Microsoft 365 tenant and preserving logs before making changes.

Source: Dark Reading

Attackers are trying to exploit the critical PHP flaws dubbed php2shell at scale, two days after the PHP project shipped fixes. Cloudflare CEO Matthew Prince says the company saw thousands of exploitation attempts in the 10 hours before the flaws were announced, rising to millions since. Amazon also saw attempts, but its websites kept running normally. No successful breaches have been confirmed so far.

Under the right conditions, the flaws let an unauthenticated attacker run code on servers running PHP, which security firm Wiz says powers 70% of the world’s websites. In the UK, tech minister Baroness Lloyd told the House of Lords that 32 government services were unavailable and four partially so, largely as a precaution while updates were applied.

Orange also suspended some services globally while it deployed fixes. Researchers scanning for exposed servers say organizations are patching more slowly than hoped, and experts warn the full impact could take months to surface.

Source: BBC News

PHP has released emergency fixes for two critical vulnerabilities, collectively called PHP2Shell, after a public proof-of-concept repository dropped verification tools and a lab setup for security testing. Both flaws, CVE-2026-109618 and CVE-2026-109619, score 9.2 on CVSS v4.0. PHP’s advisory says researchers validated unauthenticated remote code execution over HTTP against Apache’s mod_php with default settings.

One flaw stems from how PHP handles running out of memory mid-request; the other lets long-running workers carry stale memory from one request into the next, with session upload progress among its confirmed paths.

The fixes landed October 21 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. After upgrading, restart PHP workers and confirm every web-facing service runs the patched build, because updating the command-line package alone may miss PHP-FPM or Apache’s module.

Threat intelligence firm Mallory counted 883 717 internet-facing hosts on PHP 8.1 or earlier, which the PHP project no longer patches, though some Linux distributions and long-term support vendors may backport fixes.

Source: Cybersecurity News

A critical flaw in Collabora Online – Built-in CODE Server, an optional app that runs Collabora’s document server inside Nextcloud, is being actively exploited, and admins have found web shells on compromised servers. The flaw, CVE-2026-110447 (CVSS v4 9.2, Critical), lets unauthenticated attackers run OS commands as the web server user through the app’s proxy.php file, with no account or user interaction needed.

The CVE record confirms exploitation in September and October 2026. The attack window opens only when the CODE server isn’t running — during restarts, upgrades, or crashes. Standalone Collabora servers aren’t affected.

Collabora fixed the flaw in richdocumentscode 26.4.303 on September 11. Admins should upgrade to that version or later, or remove the app entirely; disabling it alone won’t stop exploitation, and the earlier fix for CVE-2025-66208 doesn’t cover it. Servers on Nextcloud 29 or older can’t install the fix and need a Nextcloud upgrade or the app removed.

Patching won’t remove a web shell that’s already in place. Admins whose servers were exposed should check for unexpected PHP files, starting with shx*.php files in the apps/richdocumentscode folder

Source: Cyber Security News

An espionage group that Mandiant tracks as Armory Castle, and researchers assess as likely China-nexus, exploited a zero-day in BeyondTrust Remote Support starting August 29, 2026. The flaw, CVE-2026-102764 (CVSS v4 9.3, Critical), stems from a messaging component that failed to validate where incoming messages came from — a serious problem in software that gives IT teams remote control over computers and servers.

Attackers moved fast. About 11 minutes after their first exploit request, a custom webshell landed. They then escalated to root, went after the appliance’s credential vault, deleted logs, and pulled internal documents off a user’s desktop. BeyondTrust knows of two affected customers so far.

BeyondTrust shipped a fix on October 8, and hosted instances are already patched. Self-hosted appliances on versions 24.3.1 through 26.2.3 need the BT26-05-RS patch; older versions must upgrade first. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 16. Mandiant warns broad exploitation may follow and advises treating unpatched internet-facing appliances as potentially compromised.

The disclosure capped a rough week, with actively exploited edge flaws from Ivanti, Cisco, and Palo Alto Networks surfacing within days of each other.

Source: Dark Reading

France’s cybersecurity agency has widened its warning over the October 11 refrigeration attack to cover Copeland XWEB and Dixell XWEB controllers alongside Danfoss AK-SM and AK-SC series. Copeland declined to confirm ANSSI’s findings at first, then acknowledged a vulnerability and said it is working with affected customers.

Danfoss points at the hardware’s age. Most affected units are AK-SM 800 and AK-SC 355 systems that reached end of life years ago and receive no patches — Danfoss stopped supporting the AK-SM 800 in May 2021, and the AK-SC 355 was discontinued in 2016. Some current AK-SM 800A controllers running outdated firmware were caught too. How the attackers got in remains unestablished, and no claim of responsibility or ransom demand has emerged.

The reach is wider than France. Sekoia told Reuters that stores in Spain, Portugal, Poland, Germany, and Belgium were also affected. Reuters puts total losses in the tens of millions of euros, and insurance brokers warn standard cyber policies often exclude physical damage.

CERT-FR wants affected controllers off the internet, with remote access restored only through a secure VPN or protected network. For compromised end-of-life devices, a factory reset won’t do — the device stays vulnerable and gets hit again if it remains exposed. Operators appear to be listening: Censys counted more than 1 800 exposed Danfoss panels in France on October 11, and 537 by October 14, with patched and unpatched versions vanishing at the same rate.

Source: SecurityWeek

SonicWall’s SMA 1000 appliances carry a flaw that scores a perfect 10.0 on CVSS, and attackers began probing for it two days after the fix shipped. CVE-2026-102255 is a pre-authentication server-side request forgery bug in the WorkPlace portal. SonicWall says an unintended access path lets a remote, unauthenticated attacker direct the appliance to issue requests on the attacker’s behalf and reach internal functionality.

The advisory landed on October 6, with SonicWall saying at the time there was no evidence any of its four flaws had been exploited in the wild. Defused logged unauthenticated SSRF traffic against its SMA decoys from October 8, and Previdian reported attempts on its sensors the next day. Benoît Sevens of Anthropic reported the flaw; technical details have not been published.

Upgrade the 6210, 7210 and 8200v to 12.4.3-03670 or 12.5.0-03082. September’s platform hotfixes, 12.4.3-03526 and 12.5.0-02952, are still vulnerable, so patching last month doesn’t cover you. There’s no workaround. SSL-VPN on SonicWall firewalls and the SMA 100 Series are unaffected.

Source: Dark Reading

A high-severity vulnerability (CVE-2026-23870, CVSS 7.5) in React Server Components lets attackers freeze Next.js servers with a single crafted POST request — no authentication needed.

The flaw lives in how React rebuilds form data before running a Server Action. A request with 10 000 references and 10 000 form fields triggers roughly 100 million string comparisons, choking the CPU and blocking Node.js’s event loop. Researcher Simon Koeck showed that a request of around 900 KB is enough to trigger that workload, and the article notes legitimate users can end up with slow loads, timeouts, or 503s.

Because the parsing happens before your Server Action’s own code runs, checks written inside the action won’t help. Public endpoints are the most exposed, but any logged-in user who can reach a Server Action is enough.

React patched versions 19.0.0–19.0.5, 19.1.0–19.1.6, and 19.2.0–19.2.5 in releases 19.0.6, 19.1.7, and 19.2.6. Check your resolved dependency tree rather than your top-level Next.js version — the affected packages are react-server-dom-webpack, react-server-dom-turbopack, and react-server-dom-parcel, and they arrive through framework dependencies. Proxy body-size limits and rate controls cut exposure, but patching React is the actual fix.

Source: Cybersecurity News

A now-patched vulnerability in AWS Bedrock AgentCore could have allowed attackers to take over every agent in an AWS account and region with a single chatbot prompt. Tamir Ishay Sharbat of Zenity Labs, an AI security vendor, revealed the flaw — dubbed “AgentCorruption” — at SecTor 2026 in Toronto.

The issue stemmed from agents running inside Firecracker MicroVMs without proper network isolation, letting attackers query AWS’s Instance Metadata Service (IMDS) for temporary credentials. From there, broad default permissions meant attackers could invoke other agents, read sessions, and raid AWS Secrets Manager.

AWS patched the flaw in February, enforcing IMDSv2 on all new agents and stripping permissions from default roles — but disputes Zenity’s framing, telling Dark Reading the research recasts documented, intended behavior as a vulnerability. Zenity is now investigating whether similar weaknesses exist on other cloud platforms, and Sharbat says the IMDS problem isn’t specific to AWS. Keep each agent’s role narrow, he says, and anyone who reaches IMDS finds a smaller blast radius.

Source: Dark Reading

ClickFix, the social engineering trick that fools users into pasting malicious commands into PowerShell, Windows Run, or the macOS Terminal, is evolving to dodge detection. Two new campaigns show attackers rebuilding the moment where a pasted command turns into a payload.

Flare researcher Assaf Morag detailed a campaign spreading CrocoRat — a remote access Trojan and crypto stealer. The victim still pastes a command from the clipboard, but that command now queries a DNS TXT record on an attacker-controlled server, and the record hands back the next PowerShell instruction. The next stage never touches the clipboard, so defenders have fewer forensics to work with.

Flare also found an unexecuted Python launcher in the package, built to choose its payload by environment: a quiet, persistent foothold on systems that look corporate, and the full RAT plus credential and crypto stealers on systems that look personal. The operator appears to be limiting theft on corporate targets to avoid tripping detection.

Microsoft Threat Intelligence flagged a separate cluster of compromised websites that pre-fetch a script into the browser cache, disguised as a PNG, before the fake prompt ever appears. That hides the payload and gets around the Run dialog's character limit. Morag's advice goes after the step itself: alert on clipboard-to-Run patterns, harden PowerShell script-block logging, stop interpreters running from writable directories, and train users on the tells — fake CAPTCHAs, press-Windows+R prompts, and verification-failed screens

Source: Dark Reading