AI-generated content. This briefing is compiled by an AI assistant from public sources. Summaries may contain errors — always verify details in the linked primary sources before acting.
This weekend’s edition is dominated by two supply-chain stories with real consequences for identity-heavy environments. CISA issued a rare formal alert on Friday urging immediate patching of BeyondTrust Remote Support after confirming that a critical authentication bypass, now tracked as CVE-2026-102764, has been actively exploited since late August — with forensic guidance up to and including rebuilding appliances and rotating every stored credential. The other big story is ConnectWise: attackers appear to have obtained service credentials for the ConnectWise Cloud Backup product (formerly SkyKick) and used the trusted backup application identities to sign directly into more than 160 Microsoft 365 tenants, self-assigning Exchange Administrator and in one case Global Administrator roles — a textbook example of third-party service-principal risk in identity platforms such as Microsoft Entra ID. In software-patching news, Drupal shipped fixes for two critical remote code execution flaws affecting every supported version and warned that exploits may appear quickly. On the OT side, NIST released a draft update of SP 800-82, the foundational OT security guide, rebuilt around Cybersecurity Framework 2.0, while CISA and the FBI published a fact sheet warning critical-infrastructure operators about third-party ICS integrators. Finally, a cyberattack on defence contractor BAE Systems disrupted the US federal bankruptcy courts’ notice system — a reminder that contractor compromise can take down government operations, not just the contractor’s own networks.
Category: IT (privileged remote access) | Severity: Critical | Status: Actively exploited; KEV added October 16; patch BT26-05-RS available
CISA on Friday urged organisations to patch a critical authentication bypass (CVE-2026-102764) in BeyondTrust Remote Support (formerly Bomgar), versions 26.2.3 and earlier. Threat actors are actively exploiting the flaw to gain initial access, then establishing persistence, escalating privileges and moving laterally. The activity has been attributed to the China-nexus espionage group tracked as Armory Castle (also known as UNC5221 or Warp Panda), which reportedly used the bug as a zero-day in late August. Patches (BT26-05-RS) are available for supported versions (24.3.1 and later); older versions must upgrade first. SaaS-hosted deployments have already been patched. CISA’s guidance is unusually heavy: conduct network and memory forensics, hunt for unrecognised privileged sessions and unexpected log gaps, rebuild from a known-good state, rotate every credential the appliance stored or injected, revoke all active support sessions, and review MFA registrations on privileged accounts. BSI rates the issue critical as well (WID-SEC-2026-4001).
Takeaway: Remote-access appliances are a repeat favourite for espionage actors — treat any BeyondTrust RS deployment like a crown jewel: patch now, then verify with forensics rather than assuming the patch closed everything.
Sources: CISA alert (Oct 16), BleepingComputer, Primary source (BeyondTrust advisory BT26-05)
Category: IT (identity / cloud / supply chain) | Severity: Critical, ongoing | Status: Service shut down; investigation ongoing
ConnectWise shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after attackers apparently obtained the service’s application credentials and used them to sign directly into customers’ Microsoft 365 tenants. Huntress confirmed at least 162 compromised tenants; Microsoft’s Threat Intelligence team characterised the incident as an active supply-chain attack, observing unauthorised authentication attempts from a single IP address (144.172.64.128) starting October 15, with scripted sign-ins (curl and Python user agents) dating back to October 13. Because the sign-ins used the application identity itself, MFA never came into play — the app already held broad, previously granted permissions to read and write mail, OneDrive, SharePoint and Teams. Persistence attempts were observed: in one tenant the MS Teams management app granted itself Global Administrator and added credentials to third-party tools. Microsoft recommends reviewing service-principal sign-ins, application credential changes and OAuth grants; Huntress advises disabling the implicated applications (app IDs listed in the article) and removing any unauthorised secrets added since October 13. Revoking user sessions does not kill application tokens — they remain valid until expiry.
Takeaway: Third-party app service principals with Directory.ReadWrite.All are effectively backdoors. Organisations should audit which backup and management apps hold privileged directory roles, monitor service-principal sign-ins separately from user sign-ins, and prune OAuth grants aggressively.
Sources: BleepingComputer, Primary source (ConnectWise advisory), Huntress analysis
Category: IT (web platform) | Severity: Critical | Status: Fixes available; public exploitation expected soon
Drupal’s security team released fixes for two critical vulnerabilities that allow remote code execution on sites running any supported version of the CMS, and explicitly warned that exploits are likely to appear quickly once details become public. Drupal powers a large share of public-sector, education and enterprise websites, and its modules run with considerable privileges on the underlying PHP stack. The advisory covers all actively maintained branches, and administrators are urged to update immediately rather than wait for routine maintenance windows — historically, Drupal core and module flaws have been mass-scanned within days of disclosure. BSI flagged the issue in its advisory stream, and the general pattern this week (Nextcloud, TeamCity, Grafana) is again one of already-available fixes waiting to be applied.
Takeaway: Internet-facing CMS platforms should follow a 48-hour patch SLA for critical advisories — the exploit window after public details now averages well under a day.
Sources: BleepingComputer, Primary source (Drupal security advisories)
Category: OT (governance) | Severity: Strategic | Status: Draft open for public comment until November 30, 2026
NIST has released a public draft of Revision 4 of SP 800-82, “Guide to Operational Technology (OT) Security”, the foundational reference for securing industrial control systems. The new draft is reorganised around NIST’s Cybersecurity Framework 2.0 and expands its coverage beyond traditional manufacturing and energy to building automation, water, food and agriculture, freight rail and maritime, with enhanced recommendations on asset management, network monitoring, security architecture and zero-trust principles applied to OT realities. In parallel, CISA and the FBI published a fact sheet for critical-infrastructure operators working with third-party ICS integrators, warning about excessive access, always-on remote connections and insufficient supply-chain requirements — the exact human and contractual paths by which attackers enter industrial networks. Public comments on the draft are open until November 30, 2026.
Takeaway: Integrator and vendor remote access is the soft underbelly of OT networks — inventory every third party with connectivity to control systems, then enforce time-boxed, monitored access with contractual security requirements.
Sources: SecurityWeek, Primary source (NIST draft SP 800-82 R4), CISA/FBI fact sheet
Category: IT (supply chain / government) | Severity: Major service disruption | Status: Investigation ongoing
A cyberattack on BAE Systems, the UK-headquartered defence contractor, has disrupted US federal court operations: the Administrative Office of the US Courts confirmed that the notice-of-bankruptcy-filing system operated by the contractor is down, taking electronic notification out of action for federal bankruptcy courts nationwide. The incident highlights how government-critical services increasingly run through a small set of private contractors, meaning a single supplier breach can interrupt judicial operations. BAE, a major defence and security company with both commercial and government contracts, has not yet disclosed the nature of the attack, whether data was stolen, or which threat actor is suspected. Courts are reportedly operating with fallback procedures while the system is restored.
Takeaway: Map your dependency on IT/OT service providers the same way you map vulnerabilities — a contractor outage is functionally the operator’s outage, and continuity plans must survive a supplier’s compromise, not just an internal breach.
Sources: BleepingComputer, Primary source (Administrative Office of the US Courts / Reuters coverage)
Disclaimer: This briefing is compiled by an AI assistant. All summaries are AI-generated from public sources; links to the original articles and advisories are provided for verification. Always confirm details in the primary sources before acting.