Threat Digest — October 18, 2026

Top Stories#

ConnectWise Cloud Backup Incident Affects Microsoft 365 Tenants

ConnectWise shut down customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after attackers accessed application identities and used the service to compromise Microsoft 365 tenants, according to BleepingComputer.

The incident calls for two parallel response tracks:

• Determine whether the organization used ConnectWise Cloud Backup or the former SkyKick Cloud Backup service.
• Review application identities, OAuth grants, service principals, mailbox access, administrative actions, and backup-related permissions.
• Revoke suspicious or unnecessary tokens and permissions.
• Rotate credentials associated with affected integrations.
• Investigate mailbox, SharePoint, OneDrive, privilege, recovery, and retention-policy changes.

A trusted backup or managed-service integration can become a cloud identity attack path. Maintain an inventory of suppliers with tenant-level access and document the permissions required for each integration.

Analyst’s Take: Start with the tenant identities and permissions tied to ConnectWise Cloud Backup rather than treating this as a conventional backup-service outage. The response should connect application, mailbox, directory, and backup activity so investigators can determine what the integration could access and whether that access was abused.

Reported BAE Systems Incident Disrupts Bankruptcy Noticing Services

A reported cybersecurity incident affecting BAE Systems disrupted the U.S. Federal Bankruptcy Noticing Center nationwide, according to a Google News report.

The available report does not establish the incident’s root cause, scope, or data impact. Organizations that depend on affected services should monitor official updates, confirm business-continuity procedures, and avoid treating third-party status information as a substitute for direct provider communications.

Loyalty-Program Data Access Reports

Save-On-Foods reported that personal information associated with loyalty-program members was accessed in a cybersecurity breach, according to Google News. Pattison Food Group separately said customer data associated with its More Rewards program was accessed, as reported by Google News.

Organizations should prepare for follow-on abuse even when payment-card exposure is not established:

• Warn users about phishing messages referencing loyalty accounts or rewards balances. These may use spear phishing techniques.
• Recommend unique passwords and monitor for credential reuse.
• Watch for credential-stuffing attempts against customer portals.
• Confirm breach-notification and privacy obligations with legal and compliance teams.
• Coordinate with customer-support teams so suspicious account-recovery requests receive additional scrutiny.

Drupal Patches Critical Remote-Code-Execution Flaws

Drupal released patches for two critical remote-code-execution vulnerabilities affecting Drupal core and the Entity List module. Drupal warned that exploitation attempts may emerge soon, according to BleepingComputer.

Prioritize systems that are:

• Internet-facing.
• Running affected Drupal core or Entity List versions.
• Used to publish or process untrusted content.
• Connected to privileged databases, internal services, or deployment systems.
• Difficult to monitor because of limited application logging.

Apply the relevant Drupal security updates, validate the deployment in staging where practical, and review web-server and application logs for suspicious requests or unexpected administrative activity. Do not wait for a public proof of concept before patching a critical, internet-facing application.

Connected Refrigeration Systems Highlight Operational-Technology Risk

A reported cyberattack involving supermarket refrigeration systems highlights the risks created when operational technology is remotely managed or connected to business networks. The incident and broader industry implications are discussed in Google News.

Food retailers and other operators should verify that:

• Refrigeration and building-management networks are segmented from corporate and guest networks.
• Vendor remote access is time-bound, approved, logged, and protected by phishing-resistant MFA where supported.
• Internet-exposed management interfaces are removed or placed behind secure access controls.
• Manual operating procedures exist for loss of connectivity or controller compromise.
• Safety, temperature, and availability alarms are monitored independently of the potentially affected control path.

AI-Accelerated Vulnerability Discovery

New research points to a record increase in vulnerability discoveries and examines the role of artificial intelligence in security research and flaw identification, according to Google News.

For defenders, the practical implication is a shorter window between disclosure and exploitation. Vulnerability-management teams should improve asset ownership, external attack-surface visibility, patch validation, and compensating controls instead of relying only on periodic scanning.

Critical Vulnerabilities#

phpMyFAQ WebAuthn Authentication Bypass

CVE-2026-111911 affects phpMyFAQ 4.0.0 through versions before 4.1.9 and has a CVSS score of 9.8. Attackers can abuse WebAuthn registration to register a passkey for another account and bypass password and TOTP authentication.

The vendor’s GitHub security advisory identifies version 4.1.9 as the fix. Upgrade immediately and review recent passkey registrations, account changes, and administrator authentication events.

phpMyFAQ Account Email and Password-Reset Takeover

CVE-2026-111884 affects phpMyFAQ versions before 4.1.9 and 4.2.0-alpha before 4.2.0-beta. A hijacked session can change an account email without requiring the current password and then use password reset to take over non-2FA accounts, including superadmin accounts.

Upgrade to 4.1.9 or 4.2.0-beta, as applicable, using the GitHub advisory. Investigate email changes, password resets, session activity, and administrator account modifications.

phpMyFAQ Broken Object-Level Authorization

CVE-2026-111908 affects phpMyFAQ 4.0.0 through versions before 4.1.9 and 4.2.0-alpha before 4.2.0-beta. Authenticated users with edit_faq permission can modify restricted FAQs they cannot view, bypass moderation, and change publication state.

Upgrade to 4.1.9 or 4.2.0-beta. Review the GitHub advisory and audit FAQ edits, permission changes, unexpected publication-state changes, and activity by accounts with content-editing privileges.

phpMyFAQ SSO and TOTP Bypass

CVE-2026-111882 affects releases before 4.1.9 and 4.2.0-beta. IdP-authenticated users may bypass TOTP through Keycloak and Entra ID SSO callbacks, creating an account-takeover risk.

Upgrade to 4.1.9 or 4.2.0-beta and review the related GitHub advisory. Check identity-provider logs for unusual callback behavior, new administrator sessions, unexpected SSO sign-ins, and authentication events that lack the expected second factor.

phpMyFAQ Superadmin Deletion Authorization Flaw

CVE-2026-111909 affects phpMyFAQ versions before 4.1.9. Authenticated non-superadmin users with delete_user permission can delete superadmin accounts because of missing authorization checks.

Upgrade to 4.1.9 and review the GitHub advisory. Audit user-deletion events, changes to delete_user permissions, and account-recovery activity.

What Defenders Should Do Today#

1. Investigate Microsoft 365 integrations. Identify tenants connected to ConnectWise Cloud Backup or the former SkyKick Cloud Backup service. Review application identities, OAuth grants, service principals, mailbox access, and administrative activity.

2. Contain suspicious cloud access. Revoke unauthorized tokens and application permissions, rotate exposed credentials, require phishing-resistant MFA where supported, and investigate mailbox, SharePoint, OneDrive, privilege, and recovery-policy changes.

3. Patch Drupal immediately. Confirm whether Drupal core and the Entity List module are affected, apply the latest security updates, and prioritize internet-facing systems.

4. Upgrade phpMyFAQ. Move affected installations to 4.1.9 or 4.2.0-beta, as applicable. Do not expose vulnerable administrative interfaces while upgrades are pending.

5. Review authentication and account-change activity. Search for unusual WebAuthn registrations, email changes, password resets, SSO callback anomalies, MFA bypasses, new administrator sessions, and unexpected account deletion. Review OTP security guidance where relevant.

6. Review third-party access. Document which suppliers can access cloud tenants, backup data, administrative APIs, identity systems, or recovery workflows. Remove unnecessary access and require explicit approval for privileged integrations.

7. Prepare for loyalty-account abuse. Monitor for phishing, credential stuffing, password reuse, fraudulent account recovery, and identity-fraud attempts involving loyalty-program users. A password manager such as Try 1Password → can help teams support unique credentials and reduce reuse.

8. Validate operational-technology segmentation. Confirm that refrigeration and other control systems are isolated from public networks and corporate user networks. Test vendor-access controls and manual fail-safe procedures.

9. Improve vulnerability response. Use external asset inventories, authenticated scanning, rapid patch validation, and compensating controls to reduce the time between disclosure and remediation.

Technical Notes#

Microsoft 365 Investigation Checklist

Use Microsoft 365 audit and identity logs to establish whether affected integrations accessed the tenant. Exact event names vary by licensing level and log source, so correlate application, sign-in, mailbox, and directory activity rather than relying on a single event type.

Prioritize searches for:

New service principal or application consent
Unexpected OAuth permission grant
Unfamiliar application or service principal sign-in
Mailbox access by an unfamiliar application
Inbox rule or forwarding-rule creation
Privileged role assignment
Conditional Access policy change
MFA or authentication-method change
SharePoint or OneDrive bulk download
Backup, retention, or recovery configuration change

A basic Microsoft Graph inventory request can help identify applications and service principals for review:

Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All"

Get-MgServicePrincipal -All |
  Select-Object Id, AppId, DisplayName, AccountEnabled

Get-MgOauth2PermissionGrant -All |
  Select-Object ClientId, ConsentType, PrincipalId, ResourceId, Scope

Treat the output as an investigation starting point. Validate each application against the organization’s approved supplier and integration inventory before revoking access.

phpMyFAQ Version and Exposure Check

Confirm the installed phpMyFAQ version from the application’s administrative interface, deployment metadata, package inventory, or release artifacts. Avoid assuming that a package name or web-server banner accurately identifies the running version.

Example deployment checks:

# Review application files where the deployment method exposes version metadata
grep -RniE 'VERSION|version' /var/www/phpmyfaq 2>/dev/null | head

# Search web-server logs for administrative and account-change paths
grep -Ei 'admin|login|webauthn|passkey|password|reset|user|faq' \
  /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/null

Search for unusual sequences rather than isolated requests:

Successful login
New WebAuthn or passkey registration
Account email change
Password-reset request or completion
Privilege or permission change
FAQ update or publication-state change
User deletion
New administrator session

Preserve relevant logs before rotating credentials or rebuilding systems. If compromise is suspected, invalidate active sessions, reset affected credentials, verify administrator accounts, and review identity-provider logs.

Drupal Patch Validation

After applying Drupal updates, verify the installed core and module versions using the organization’s supported package-management or deployment process. A Composer-managed deployment may use commands such as:

composer show drupal/core-recommended drupal/entity
composer audit

Do not infer that an installation is safe solely because Composer completed successfully. Confirm that:

• The updated code is deployed to the production web root.
• All application nodes and containers received the update.
• Caches were rebuilt where required.
• Internet-facing administrative paths remain protected.
• Web and application logs were reviewed for suspicious requests before patching.

Operational-Technology Access Review

For connected refrigeration and similar control systems, document every remote path into the environment:

Internet or vendor portal
Remote-access gateway
Jump host or management workstation
Building-management or refrigeration network
Controller, sensor, or actuator

Validate that each transition is authenticated, logged, segmented, and limited to the minimum required function. Test whether loss of the remote-management platform leaves temperature monitoring, alarms, and manual control available.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.