Tag: unauthorized
-
ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident
ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup.The company said it has completed the following actions since it began First seen on…
-
Claude Code Detects Hidden XMRig Cryptominer Consuming 1175% CPU on Mac
A Mac user reported that Anthropic’s Claude Code found an unauthorized XMRig cryptocurrency miner while helping develop a temperature-monitoring application. The mining process reportedly consumed approximately 1,175% CPU, equivalent to nearly 12 fully utilized processor cores, which explained the machine’s sluggish performance. Claude Detects Hidden XMRig The account, shared by Reddit user u/UntilHEX, describes an…
-
ConnectWise suspends Cloud Backup service after supply chain attack
ConnectWise initially said on Friday that it was investigating “attempts of unauthorized access associated with the ConnectWise Cloud Backup environment,” and confirmed such access on Saturday. First seen on therecord.media Jump to article: therecord.media/connectwise-suspends-cloud-backup-service-supply-chain-attack
-
ConnectWise Suspends Cloud Backup Services as It Probes Hack
Stolen API Secret for M365 Tied to ConnectWise App Abuse, Potential Data Breaches. ConnectWise is probing attacks that used a stolen API secret to gain access to organizations that use its cloud-based backup and restoration software for Microsoft 365. Attackers appear to have gained unauthorized access to at least 300 organizations, and potentially many more.…
-
19th October Threat Intelligence Report
CenterPoint Energy, a US utility company serving Texas and several other states, has disclosed a data breach affecting more than 1 million Texas residents. Unauthorized access to an external system exposed names, […] First seen on research.checkpoint.com Jump to article: research.checkpoint.com/2026/19th-october-threat-intelligence-report/
-
Attackers Abuse Stolen ConnectWise Application Credentials to Target Microsoft 365
Attackers stole ConnectWise application credentials to access Microsoft 365 tenants, prompting the company to suspend cloud services. ConnectWise suspended its Cloud Backup service and took both SaaS Security and Cloud Management offline over the weekend after discovering that unknown attackers had obtained unauthorized access to seven of its application identities. The company discovered the incident…
-
ConnectWise Shuts Off Cloud Services After ‘Unauthorized Access’ to Microsoft 365 Tenants
Cloud Backup, SaaS Security, and Cloud Management services offline as IT service provider investigates possibility that unknown attackers have full access to client environments via stolen tokens First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/connectwise-shuts-off-cloud/
-
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants.The disabled identities are listed below – ConnectWise Cloud Backup – 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise First seen on thehackernews.com Jump to article:…
-
Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise to shut off application access and interrupt backup services. Jonathan Semon confirmed unauthorized sign-ins across 162 tenants as of 19:00 UTC on October 16, exposing risks associated with privileged vendor applications. ConnectWise said in its October 17 update, supplied for…
-
Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise to shut off application access and interrupt backup services. Jonathan Semon confirmed unauthorized sign-ins across 162 tenants as of 19:00 UTC on October 16, exposing risks associated with privileged vendor applications. ConnectWise said in its October 17 update, supplied for…
-
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Tags: access, backup, cloud, credentials, cybersecurity, hacker, microsoft, service, threat, unauthorizedCybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers’ M365 environments.ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs First…
-
Employees using personal ChatGPT at work? Here’s what IT admins need to do
Employees using personal ChatGPT accounts at work can expose sensitive company data, even when their organization provides an approved Enterprise workspace. NordLayer explains how IT teams can investigate unauthorized AI use and block sensitive information before it reaches personal accounts. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/employees-using-personal-chatgpt-at-work-heres-what-it-admins-need-to-do/
-
CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing
AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In said in an advisory on October 15.The agents went beyond their assigned tasks, and none of the organizations detected the unauthorized access. After internal reviews, the AI companies whose models were being…
-
Hackers Use Compromised Credentials to Infiltrate European Bank Through VPN
Tags: access, attack, authentication, credentials, cyber, defense, endpoint, finance, hacker, infrastructure, network, unauthorized, vpnHackers used compromised credentials to infiltrate a European bank through a misconfigured, third-party-managed VPN gateway, conducting months of reconnaissance and authentication attacks before endpoint defenses blocked an attempted escalation. The bank engaged Palo Alto Networks’ Unit 42 after its internal security team identified unusual activity affecting central IT infrastructure and uncovered unauthorized remote access attempts…
-
Fake WatchGuard VPN Site Steals Credentials Then Delivers Legitimate Signed Installer
A WatchGuard VPN impersonation attack that steals connection credentials in the browser before delivering the vendor’s genuine, digitally signed installer. The campaign removes the malicious executable from the download chain, leaving victims with legitimate software. At the same time, attackers collect information needed to attempt unauthorized VPN access. The lure, watchguard-vpn[.]net, impersonated a WatchGuard Mobile…
-
Critical Docker Hub Vulnerability Lets Attackers Impersonate Users and Tamper With Container Images
Docker disclosed a critical vulnerability in Docker Hub that let attackers impersonate other users at the container registry level. This flaw, tracked as CVE-2026-105445 and dubbed GhostPat, exploited how Docker handled personal access tokens during account conversions. Depending on token permissions, it could enable unauthorized image downloads, malicious image uploads, and repository image deletions. Docker…
-
SonicWall Fixes 4 SMA 1000 Vulnerabilities, Including Critical CVSS 10.0 SSRF Flaw
SonicWall released security updates to address four vulnerabilities in its SMA 1000 series appliances, including a critical server-side request forgery (SSRF) flaw rated 10.0. These vulnerabilities could allow unauthorized operations, operating system command execution, malicious archive extraction, and stored cross-site scripting. Published on October 6, 2026, advisory SNWLID-2026-0017 covers CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, and CVE-2026-102258. SonicWall…
-
Critical MariaDB Vulnerabilities Could Enable Remote Code Execution and Privilege Escalation
MariaDB maintainers have disclosed ten vulnerabilities affecting database server components, Linux packaging, and Connector/C. Under specific conditions, these flaws could lead to remote code execution, privilege escalation, unauthorized table access, and credential theft. Although the headline uses >>Critical,<< the advisories classify six vulnerabilities as High and four as Moderate; none has a Critical rating. Critical…
-
12th October Threat Intelligence Report
Denmark’s government has disclosed a breach involving its Central Register of Persons after unauthorized individuals exploited access provided to a private supplier. The incident reportedly exposed personal information, including names, addresses, and […] First seen on research.checkpoint.com Jump to article: research.checkpoint.com/2026/12th-october-threat-intelligence-report/
-
Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports
Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via Cryptobilis following reports of stolen funds linked to devices sold by the reseller.On Friday, the company said it was investigating reports of loss of funds from users in Southeast Asia who had purchased products from CryptoBilis. The incident is said to have resulted…
-
Ransomware Hackers Exploit Palo Alto Networks GlobalProtect VPN Authentication Bypass Vulnerability
Tags: access, attack, authentication, cve, cyber, exploit, flaw, group, hacker, network, ransomware, threat, unauthorized, vpn, vulnerabilityRansomware operators are actively exploiting CVE-2026-0257, an authentication bypass vulnerability affecting Palo Alto Networks PAN-OS GlobalProtect and Prisma Access. It lets them establish unauthorized VPN sessions and infiltrate internal networks. ReliaQuest has identified multiple threat groups leveraging this flaw, including the Qilin and Settra ransomware operations. These attacks use a trusted remote-access pathway rather than…
-
Attackers Use Power BI Phishing to Install Multiple RMMs and Maintain Persistent Access
Attackers abused Microsoft Power BI to deliver unauthorized ScreenConnect remote monitoring and management (RMM) clients, using trusted Microsoft infrastructure to disguise phishing links and establish persistent access. Huntress observed the campaign beginning September 10, 2026, across several endpoints. A retrospective hunt linked one distinctive ScreenConnect client configuration to 22 additional endpoints across separate incidents, rather…
-
Claude AI Exploits SQL and Command Injection Flaws to Execute Commands on Third-Party Servers
Anthropic revealed that its Claude models had exploited SQL and command injection vulnerabilities, submitted unauthorized forms, and bypassed access restrictions during evaluations and internal use. The company said these incidents had minimal real-world impact. However, it led it to restrict live internet access across all internal evaluations while it validated stronger safeguards. The findings highlight…
-
Wikimedia Says Rogue AI Agents Abused its Platforms
Wikimedia says OpenAI agents performed unauthorized actions on its platforms, including edits to wikis First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/wikimedia-confirms-platforms-rogue/
-
Critical Sungrow Authentication Bypass Flaw Lets Hackers Take Control of Solar Power Plants
Tags: access, authentication, business, control, cyber, data-breach, flaw, hacker, unauthorized, vulnerabilityA critical authentication bypass vulnerability in Sungrow’s iSolarCloud management platform allowed researchers to access user and administrator accounts without valid passwords. This flaw potentially exposed connected solar plants, inverters, and battery storage systems to unauthorized control. On October 7, 2026, Marlon Starkloff disclosed these findings, highlighting a business logic flaw affecting all four regional iSolarCloud…
-
Attackers Hijack Three ccTLDs to Obtain Google Certificates
Attackers compromised .gh, .sl and .as registries to obtain unauthorized HTTPS certificates First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/attackers-hijack-cctlds-obtain/
-
Critical Gitea Vulnerabilities Allow Attackers to Bypass Authentication and Execute Code
Gitea has released version 28.0.0, addressing 20 vulnerabilities related to authentication bypass, unauthorized workflow execution, server-side request forgery, stored cross-site scripting, and denial of service. Announced on September 30, 2026, this release removes the historical “1.” version prefix. Maintainers have urged administrators to upgrade promptly to mitigate vulnerabilities affecting repository access, automation, and outbound connections.…
-
CMMC and AI Governance: How to Keep CUI Out of AI Tools
Treat AI as Another Data Channel to Find, Mark and Control Sensitive Defense Data Banning AI outright defeats the purpose of adopting it, but defense contractors still must keep controlled unclassified information out of unauthorized AI tools. The answer is to govern AI with the same data-first principles CMMC requires: Find CUI, mark it, control…
-
Attackers Hijack .gh, .sl, and .as Domains to Obtain Unauthorized SSL Certificates
Attackers compromised the infrastructure of third-party country-code top-level domains (ccTLDs) for Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as). They modified authoritative DNS records to obtain unauthorized HTTPS certificates for Google domains and other organizations. Attackers Hijack Domains In a disclosure on October 6, 2026, Chrome’s Secure Web and Networking Team stated that these…
-
Hackers hijack Google domains after breaching ccTLD registries
Hackers obtained unauthorized HTTPS certificates for several Google domains and hijacked domains in the country-code top-level domains (ccTLDs) for Ghana, American Samoa, and Sierra Leone after compromising third-party operators and modifying authoritative DNS records. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-hijack-google-domains-after-breaching-cctld-registries/