Latest / Daily DefSec Brief / ConnectWise app breach hits M365 tenants, FortiGate memory implant | Cyber Security News Oct 19
Transcript
- Jerry: Somewhere on your network, a login protocol from 1993 is still at work. This month Windows started saying no to it. This is the daily DefSec brief for Monday, October 19th, 2026. If you only do one thing today, check every Microsoft 365 tenant for Connect-Wise app identities and the roles they hold. One, attackers signed into hundreds of Microsoft 365 tenants using ConnectWise's own app credentials. They signed in as ConnectWise Cloud Backup, the old SkyKick app, which customers had already approved. Huntress counted more than 300 tenants with successful sign-ins from the attacker's address. In one tenant, Huntress also saw a ConnectWise management app make itself a global administrator. ConnectWise has switched its apps off. Disable them in your own tenants too and remove any admin role you didn't grant. While you're in there, look at which other vendor apps hold admin roles. Number two, attackers are already using a Forti OS flaw that turned an admin login into root on FortiGate firewalls. It started with a break-in at a telecom MSP's Forti manager through a flaw from 2024. From there, they took the settings for more than 500 firewalls and later came in over a VPN with real credentials. The implant they planted, Peer Stitch, lives only in memory. Patch Forti OS. The fix has been out since April and older release lines need a migration instead. Then rotate every credential your Forti manager holds. Three, Someone holding stolen Updraft Central keys is installing backdoor plugins on WordPress sites. Updraft Central ships inside every copy of Updraft Plus, a backup plugin on more than 4 million sites. The commands are properly signed so every check in the plugin passes. The signatures are working perfectly, just for the wrong person. No plugin updates stops it yet. Delete the Updraft Central Keys from your sites. Removing the plug-in doesn't remove the backdoor account. Four Between April and July, attackers rewrote Aomi Backuppers update files for five to ten minutes at a time. Any copy that checked for an update in those minutes ran a downloader that installed a backdoor. Aomi says it secured its servers, but machines already hit stay infected. If you run Aomi software, hunt for a scheduled task called Radmin Component Runtime. 5. No attacks reported on the Linux KVM escape we covered two weeks ago, and now it has a fix. A guest virtual machine can send packets that could let it run code on the host underneath. The flaw is called PwnEscape, and the kernel fix is rolling out to the major distributions. Patch the kernel on your KVM hosts. The ones running untrusted guests first. Six. No attacks yet, but a maximum severity magento flaw can run code on store servers through its email templates. It uses a gap left by September's emergency fix. The flaw that fixed close was mass exploited within three days. That's the second Magento email template hole we've covered in six weeks. Apply Adobe's October Magento patch now. Seven, no attacks yet, but MoveIt Transfer has fixes for twelve high severity flaws. Several of them weighs around the login. Upgrade, move it, transfer. Eight. No attacks reported, but Firefox one hundred fifty eight fixes seventy seven security flaws. Thirty of them rated high. Push the Firefox and Thunderbird update. 9. No attacks yet, but Apache's Airflow, SSH, and SFTP connections accept any server's key by default. Someone sitting between a worker and a server can take over the session and its credentials. Upgrade Airflow's SSH and SFTP providers. 10. OpenAI publishes an official skill for deploying apps on render. It gave the private network address as render-internal.com. That domain wasn't registered In testing, OpenAI's Codex wrote it into app code as the default address. Researchers registered it, and real production apps started sending it requests with their tokens. Render fixed the skill in August. Search the code for render-intern.com And rotate any token those apps sent. Eleven. October's Windows Update now blocks sign-ons that relies on old NTLM version one. It applies to machines where credential guard is turned off. That can break Wi-Fi, wired, and VPN logins that still rely on it. The Quick Fix is a register value that sets it back to logging only. Find what still depends on NTLM version one and move it to something supported before you reach for that setting. Odds are the help desk hears about it before you do. Once more, check your tenants for ConnectWise apps and the roles. Thanks for watching. Sources are in the show notes. Like, subscribe and share the show with a friend who uses it. We'll be back again tomorrow.