Daily DefSec Brief·Oct 19, 2026·5m

ConnectWise app breach hits M365 tenants, FortiGate memory implant | Cyber Security News Oct 19

Show notes

1. ConnectWise app credentials used on M365 tenants - Do: Disable ConnectWise app identities and audit their roles - https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access

2. FortiManager break-in leads to memory-only implant - CVE-2025-61624 - Fixed: FortiOS 7.6.5 or 7.4.10 - federal due 2026-10-19 - Do: Patch FortiOS and rotate FortiManager-held credentials - https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/

3. Stolen UpdraftCentral keys backdoor WordPress - Do: Delete UpdraftCentral keys from your WordPress sites - https://patchstack.com/articles/updraftcentral-key-compromise-wordpress-backdoors/

4. AOMEI update servers tampered with for minutes - Do: Hunt AOMEI machines for the RadminComponentRuntime task - https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering/

5. Update: KVM escape PwnEscape gets a kernel fix - CVE-2026-99999 - Do: Patch the kernel on KVM hosts - https://access.redhat.com/security/cve/cve-2026-99999

6. Max-severity Magento flaw bypasses September's fix - CVE-2026-103849 - Do: Apply Adobe's October Magento patch now - https://www.adobe.com/trust/security/products/commerce/apsb26-153.html

7. MOVEit Transfer fixes 12 high-severity flaws - CVE-2026-89067 - Fixed: 2025.1.6 or 2026.0.4 - Do: Upgrade MOVEit Transfer - https://cyber.gc.ca/en/alerts-advisories/progress-security-advisory-av26-1058

8. Firefox 158 fixes 77 flaws, 30 high - Fixed: Firefox 158, ESR 153.5 or 115.43 - Do: Push the Firefox and Thunderbird updates - https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/

9. Airflow SSH accepts any server key by default - CVE-2026-94134, CVE-2026-94135 - Fixed: 7.0.0 - Do: Upgrade Airflow's SSH and SFTP providers - https://www.ox.security/blog/by-default-insecure-apache-airflow-disables-ssh-host-key-verification/

10. Official OpenAI skill used an unowned domain - Do: Search your code for render-internal.com - https://www.air.security/blog-posts/render-openai

11. Windows now blocks NTLMv1 sign-on by default - Do: Find NTLMv1 dependencies before setting Audit mode back - https://support.microsoft.com/help/5066470

← Previous

BeyondTrust zero-day exploited, Atlassian flaw under attack | Cyber Security News Oct 16

Attackers used ConnectWise's app credentials to enter Microsoft 365 tenants. Also: a FortiGate implant, stolen UpdraftCentral keys, NTLMv1 blocks, AOMEI's update servers, and fixes. Every version number and every fix in this episode was checked against the vendor's advisory or the CVE record before it aired. Today's question: How do you review vendor apps in your tenant? Reply in the comments or at [email protected] . 1. ConnectWise app credentials used on M365 tenants - Do: Disable ConnectWise app identities and audit their roles - https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access 2. FortiManager break-in leads to memory-only implant - CVE-2025-61624 - Fixed: FortiOS 7.6.5 or 7.4.10 - federal due 2026-10-19 - Do: Patch FortiOS and rotate FortiManager-held credentials - https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/ 3. Stolen UpdraftCentral keys backdoor WordPress - Do: Delete UpdraftCentral keys from your WordPress sites - https://patchstack.com/articles/updraftcentral-key-compromise-wordpress-backdoors/ 4. AOMEI update servers tampered with for minutes - Do: Hunt AOMEI machines for the RadminComponentRuntime task - https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering/ 5. Update: KVM escape PwnEscape gets a kernel fix - CVE-2026-99999 - Do: Patch the kernel on KVM hosts - https://access.redhat.com/security/cve/cve-2026-99999 6. Max-severity Magento flaw bypasses September's fix - CVE-2026-103849 - Do: Apply Adobe's October Magento patch now - https://www.adobe.com/trust/security/products/commerce/apsb26-153.html 7. MOVEit Transfer fixes 12 high-severity flaws - CVE-2026-89067 - Fixed: 2025.1.6 or 2026.0.4 - Do: Upgrade MOVEit Transfer - https://cyber.gc.ca/en/alerts-advisories/progress-security-advisory-av26-1058 8. Firefox 158 fixes 77 flaws, 30 high - Fixed: Firefox 158, ESR 153.5 or 115.43 - Do: Push the Firefox and Thunderbird updates - https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/ 9. Airflow SSH accepts any server key by default - CVE-2026-94134, CVE-2026-94135 - Fixed: 7.0.0 - Do: Upgrade Airflow's SSH and SFTP providers - https://www.ox.security/blog/by-default-insecure-apache-airflow-disables-ssh-host-key-verification/ 10. Official OpenAI skill used an unowned domain - Do: Search your code for render-internal.com - https://www.air.security/blog-posts/render-openai 11. Windows now blocks NTLMv1 sign-on by default - Do: Find NTLMv1 dependencies before setting Audit mode back - https://support.microsoft.com/help/5066470