Archive for October 2026
SafePay Ransomware Wipes Backups First
SafePay ransomware has compromised at least 600 organizations since August 2024, and a joint advisory published on October 20 says its operators halt shadow copies and reset backup storage before they encrypt anything. The FBI, CISA and the US Secret Service wrote it together with Germany’s Landeskriminalamt Rheinland-Pfalz and UK law enforcement (the National Crime…
Read MorePHP Critical Vulnerabilities Leaked Before Patch
Two critical PHP vulnerabilities leaked before their patch, early attacks are reported, and the EU’s CERT says internet-facing applications may need to be isolated until it is installed. PHP’s security team has scheduled the fix for October 21 at 14:00 UTC (16:00 CEST). Both flaws are rated CVSS v4.0 9.2, and researchers report remote code…
Read MoreConnectWise Cloud Backup Incident and Microsoft 365
In mid-October, Huntress and Microsoft reported that attackers had abused a compromised vendor-side credential associated with ConnectWise Cloud Backup (formerly SkyKick) to sign in to customers’ Microsoft 365 tenants. ConnectWise confirmed unauthorized access to its Cloud Backup application identities and took containment measures. Many managed service providers (MSPs) use Cloud Backup to copy their clients’…
Read MoreNextcloud Collabora Vulnerability Exploited
A Nextcloud Collabora vulnerability in the optional Built-in CODE Server app has let attackers plant web shells on Nextcloud servers since September 10. Collabora fixed it on September 11 without a security notice, and the CVE (CVE-2026-110447) followed only on October 14. Disabling the app does not close the hole: update it or remove it.…
Read MoreBeyondTrust Remote Support Zero-Day Exploited
A BeyondTrust Remote Support zero-day has been exploited since August 29, and CISA added it to the Known Exploited Vulnerabilities catalog on October 16. Google’s Mandiant ties the attacks to Armory Castle, a China-linked espionage group, and says any internet-reachable appliance on a vulnerable version should be treated as potentially compromised until it has been…
Read More