Author: The Virus Informer

Drupal has released patches for two critical vulnerabilities affecting all supported versions of its content management system. The flaws exist in the Field UI module within Drupal core and the Entity List contributed module, both of which could enable remote code execution on affected websites. The Drupal Security Team warned that attackers may develop working exploits within hours or days of the vulnerabilities becoming public, urging administrators to apply updates immediately.

Site administrators are advised to update Drupal core to versions 10.6.19, 11.3.19, or 11.4.10 depending on their release branch, and to update the Entity List module to version 3.0.10. For those unable to upgrade immediately, Drupal recommends uninstalling the Field UI module as a temporary protective measure. The vulnerabilities affect over one million websites that use Drupal, a popular open-source platform especially among government agencies, universities, and non-profit organizations.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Researchers have identified a malicious npm package called “imgdecode” as part of a supply chain attack campaign named MALFEX. Uploaded on September 30, 2026, the package contains a Windows dynamic-link library that downloads encrypted shellcode from GitHub, decrypts it, and injects it into a new process when loaded. The package has been downloaded 979 times and remains available on npm. The MALFEX campaign, active since August 2023, has distributed eight malicious packages across five publisher accounts designed to compromise Windows systems through various infection methods.

The threat actor behind MALFEX has demonstrated responsiveness to public disclosures and npm removals by quickly publishing replacement packages. The malware performs anti-analysis checks and harvests sensitive files, cryptocurrency wallet information, and data from web browsers and gaming applications. It also establishes command-and-control connections enabling shell execution, file transfers, and system monitoring. Developers who installed these packages should immediately isolate affected Windows systems, check for persistence mechanisms, rotate credentials, and move cryptocurrency to new wallets if seed phrases were compromised.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

ConnectWise has suspended access to its Cloud Backup service following a security breach involving unauthorized access to application identities that compromised Microsoft 365 tenants. The attack began around October 15 from a single IP address, with Huntress identifying at least 162 compromised tenants. Microsoft confirmed the malicious activity on the same date. The attacker used the backup service’s existing permissions to access customer data, including emails, files, and Teams chats. Since the attack involved automated scripts rather than user logins, security measures like multi-factor authentication proved ineffective.

Multiple cybersecurity firms documented the breach’s scope and methods. Todyl researchers found that attackers directly authenticated to Microsoft 365 using the backup application’s credentials, while Huntress observed persistence attempts on nearly 50 monitored tenants where attackers assigned themselves administrative roles. Microsoft characterized the incident as an active supply-chain attack. ConnectWise stated that stored backup data had not been compromised and would remain accessible once services resume, though the company provided no timeline for restoration. Administrators have been advised to review application credentials, sign-in activities, and remove unauthorized additions since October 13.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Information technology administrators face challenges when employees use personal ChatGPT accounts on work devices, even when organizations provide corporate subscriptions. Security teams must identify which employee and account are involved, determine what sensitive information may have been submitted to the service, and understand why the employee bypassed the approved corporate tool. Common reasons include expired sessions, slow authentication processes, or employee confusion about policies. Administrators should then assess the severity of any data exposure and determine appropriate next steps based on what information was actually shared.

To prevent future incidents, IT leaders should ensure corporate ChatGPT access functions reliably so employees have no reason to use personal accounts. They should also review and clarify data submission policies. Some security tools can block prompts containing specific sensitive data patterns before information leaves the device, stopping submissions automatically and notifying employees of the restriction. Documentation of incidents should accurately record only confirmed facts about what occurred and which controls either failed or successfully prevented data exposure, without speculation about whether data entered model training or became public.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Cybersecurity researchers have identified an active attack campaign in which unknown threat actors are exploiting a compromised Microsoft 365 credential from ConnectWise Cloud Backup to gain unauthorized access to customer environments. Security firm Huntress confirmed unauthorized sign-ins across 173 partner and customer tenants using the stolen credential. Because ConnectWise Cloud Backup requires broad permissions to access mailboxes, OneDrive, SharePoint, Teams, and directory data, attackers with the compromised credential can access sensitive information across affected organizations. The attacker used a specific IP address to obtain tokens and systematically moved through tenants in a scripted manner between October 15 and early morning hours UTC.

In response, ConnectWise has suspended Cloud Backup application access pending further investigation. Security researchers recommend that organizations immediately disable the application, enable Microsoft Graph activity logging, and audit for any unauthorized credential additions or suspicious directory role assignments since October 13. Experts caution that some types of unauthorized access may leave no audit trail, making immediate action preferable to waiting for evidence of data compromise. ConnectWise stated it found no evidence that customer backup data was compromised, though the full impact depends on permissions configured in each affected tenant.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

A maximum-severity vulnerability affecting Magento and Adobe Commerce platforms could allow hackers to execute malicious code on store servers. Known as BlockStrap and identified as CVE-2026-103849, the flaw impacts September versions of Adobe Commerce and Magento Open Source through 2.4.9, as well as Adobe Commerce B2B through 1.5.3. Security researchers at Sansec have identified four potential attack paths within 24 hours, though active exploitation has not yet been documented.

Sansec researchers contend that Adobe’s priority rating of the vulnerability does not adequately reflect its severity and urgency, warning that attackers using artificial intelligence tools could develop working exploits relatively quickly. The company notes that administrators must apply both the latest patches and previous security fixes to fully address the risk, as BlockStrap and an earlier flaw called StyleSmuggler require separate corrections. Sansec expects mass attack campaigns to begin soon and plans to provide updates as attacks emerge.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.