The Pillow maintainers released Pillow 13.0.0 on 16 October 2026 (UTC) and published 40 GitHub security advisories for it on 17 October: two rated critical, 13 high, 22 medium and three low. The most serious, CVE-2026-112398, is a heap buffer overflow in the FlashPix (FPX) JPEG-tile decoder; the reporter shows code execution from a single crafted file passed to Image.open(), and because Pillow detects FPX by its content rather than its extension, any service that opens or thumbnails untrusted uploads is reachable when the optional olefile package is installed. Other high-severity fixes include JPEG encoder and decoder heap overflows (CVE-2026-96778 when re-saving a JPEG with its colour profile, CVE-2026-112403 via Image.thumbnail()), TIFF out-of-bounds reads that can leak heap memory into pixels, and a heap-buffer-overflow write in the OpenJPEG library bundled in every Pillow wheel since 11.1.0 (CVSS 3.1 8.1), which a patched operating system does not fix. CVE-2026-112900 is a Ghostscript argument injection in EPS handling when a file name starts with a dash. Most of the rest are denial-of-service bugs (decompression-bomb bypasses, infinite loops, quadratic parsing). Some were found by Anthropic using Claude and validated by Ada Logics. Red Hat began listing the CVEs on 19 October. A further medium advisory published 19 October (Arrow export leaking heap memory when PILLOW_ALIGNMENT is above 1) also affects 13.0.0 and has no fixed release yet. No exploitation has been reported. (source: Pillow on GitHub) UPDATE (23 Oct 2026): The CVE records published by GitHub, the CVE numbering authority, on 19 October (UTC) score four of the flaws 9.2 under CVSS 4.0: CVE-2026-112398 (FlashPix decoding), CVE-2026-112403 (JPEG decoding after draft()), CVE-2026-112393 (heap buffer overflow when saving TIFF to BytesIO) and CVE-2026-112900 (argument injection in the Ghostscript call, potentially leading to code execution). The maintainers' own advisories rate those four critical, high, high and medium respectively. In the same records, CISA's ADP enrichment records a public proof of concept for CVE-2026-112398, CVE-2026-112403 and CVE-2026-112393, and no known exploitation for CVE-2026-112900. Pillow 13.0.0 remains the fixed release. (source: CVE.org records)
Pillow GHSA-5x8w-8jj5-q52h — FlashPix (FPX) JPEG decoding heap buffer overflow leads to code execution (CVE-2026-112398, critical; 17 Oct 2026)
Bullhorn, a US company whose cloud applicant-tracking and CRM software is used by staffing and recruitment firms (more than 10,000 customers worldwide, according to the company), disabled access to its platform after detecting what it calls a cyber incident on the Bullhorn Platform. Its status page shows login errors across all ATS/CRM clusters, including the Australian clusters CLS61 and CLS62, from 05:24 EDT on 17 October (5:24 pm Perth), a system-wide outage by 08:04 EDT, and at 15:28 EDT (3:28 am Perth, 18 October) the statement that a cyber incident had been detected, access had been temporarily disabled to contain the activity, and CrowdStrike specialists were assisting. Bullhorn brought its Australian, EMEA/UK and US regions back online on 19 October; at 16:54 EDT (4:54 am Perth, 20 October) it said all regions were online and that it had fixed sign-in problems for SSO customers. In its customer FAQ (last updated 19 October, 5:15 pm ET) Bullhorn says it has isolated the issue and removed the immediate threat, that the incident affected Bullhorn ATS/CRM, and that there is no indication other Bullhorn products, including its Salesforce-based products, Bullhorn Automation, SourceBreaker and VMS Sync, were affected. Its forensic investigation is ongoing and it has not yet determined whether customer data was exfiltrated; it says it will contact affected customers and meet notification obligations if data was affected. Non-SSO users must reset their password at their next login (with two-factor verification), API user passwords have been expired and must be changed, and client secrets will have to be rotated later. Bullhorn Back Office passwords were not reset and were not affected. To reduce risk Bullhorn removed the underlying technology behind a significant number of features, so some functions remain offline or changed while they are rebuilt, including the legacy ATS/CRM SOAP APIs, several integrations and job publishing. Bullhorn warns that criminals may pose as Bullhorn staff by email, text or phone using the incident as a pretext, and says it will never ask for passwords, MFA codes or verification tokens. It has not said what kind of attack it was or who was behind it. UPDATE (23 Oct 2026; Bullhorn status page): In an update posted at 6:28 pm US Eastern on 22 October (6:28 am Perth, 23 October), headed 'Update on PHP Vulnerabilities and Service Restoration', Bullhorn said Talent Platform access had been fully restored and listed Talent Platform, FastForward, Market IQ, TargetRecruit, SourceBreaker, Bond APAC Job Portal and Akyla as 'Upgraded to address the vulnerabilities and fully available', with the Back Office (BBO) 'Upgrade in progress'. It said: 'We recommend that customers plan for BBO to remain unavailable through the end of this week.' In a separate 'Status Update: Bullhorn Back Office' posted at 6:30 pm US Eastern on 22 October, Bullhorn said: 'Whilst we are in this extended outage, we will not be able to provide user access to enter time sheets and we recommend using alternative approaches', adding that Bullhorn Support can run payroll reports for customers. On 23 October (Perth) the status page listed every ATS/CRM cluster, including the Australian clusters CLS61 and CLS62, as 'Degraded Performance' and Bullhorn Back Office, including BBO SYD, as 'Major Outage'. Bullhorn's 22 October update links the Back Office work to the PHP vulnerabilities; it does not say whether it is connected to the 17 October incident. (sources: Bullhorn status page; BleepingComputer) UPDATE (24 Oct 2026; Bullhorn status page): in an update headed '[6:30 PM EST 10/23/2026]' (incident first posted at 3:01 pm US Eastern on 23 October, 3:01 am Perth 24 October) Bullhorn said 'Access to BBO has been restored', that time entry with existing credentials is available and password changes are not required. In a separate update with the same heading it said 'All products are available, but some features are still impacted', that Canvas in the ATS is not yet available and that some users are still having login issues. On 24 October (Perth) the status page listed BBO SYD as 'Degraded Performance' and the Australian ATS/CRM clusters CLS61 and CLS62 as 'Under Maintenance'.
Bullhorn Status — Update on PHP Vulnerabilities and Service Restoration; Status Update: Bullhorn Back Office (22 Oct 2026)
STAR Labs (Singapore) published a teardown on 17 October 2026 of an Android remote-access trojan family it calls Black Hawk, after its operator panel, which brands itself 黑鹰安卓远控 ('Black Hawk Android Remote Control') or, on a second host, 雄鹰安卓远程 ('Eagle Android Remote'). The researchers analysed 64 samples first seen between 15 September and 16 October 2026. Each is a small dropper that asks for permission to install other apps and then installs a packed second-stage WebSocket RAT. The same RAT is dressed up as many different apps: Japan's e-Tax service, Rakuten and Mitsui Sumitomo (SMBC) card points, Saison, Mercari, LINE points, a fake SpaceX '6G' investment app, dating apps and live-TV players. App names carry invisible zero-width characters between letters so simple name-based detection rules miss them, and each fake app opens the real brand's website as cover. Droppers are packed either with a simple native XOR stub (libsa.so, whose key sits in plain text) or with the open-source nmmp VM protector, which STAR Labs says can be undone because its VM is a reshuffled copy of Android's own interpreter. All samples are signed with the public Android debug certificate, so grouping by certificate is useless. Once installed, the RAT talks to its panel over an authenticated, certificate-pinned WebSocket; streams and remotely drives the screen through Accessibility gestures; captures the lock-screen password, PIN and pattern and keystrokes; scrapes typed values from Alipay and WeChat; injects JavaScript into WebViews; and can launch or block apps. It also pairs with the phone's own wireless ADB service to grant itself WRITE_SECURE_SETTINGS, and persists through device-admin, boot, push-message, job and alarm hooks running in a separate process. STAR Labs judges the operation financially motivated and commodity-grade. Two panels (www.mm2mm[.]xyz and www.hyzj[.]shop) were live on 16 October; C2 and distribution hosts sit mostly on Alibaba Cloud and rotate often. Published indicators include C2 domains www.mengm[.]shop, cihqobpe.receivewelfarebenefits[.]com, www.collectpointsjp[.]com, www.knjw[.]shop and tnt.freedomdf[.]xyz, and the romance front datingparadise[.]vip. No CVE or vendor patch is involved, and the lures target Japanese users; no Australian victims are reported. (source: STAR Labs)
STAR Labs — Two Hawks in a Pod: one Android RAT behind a flock of fake Japanese brands (17 Oct 2026)
OpenCode, the open-source AI coding agent, said on its official X account on 17 October 2026 (UTC) that it had a security breach the previous night, related to what it called a large-scale distillation attack, that affected 1.4% of OpenCode Console users. The company said it notified all affected users by email that morning, that users who did not get an email were not affected, and that the affected group was a subset of users who had external providers set up. An earlier version of the post said the incident was ongoing, so OpenCode could not share more details yet. OpenCode has not said how the attackers got in or how many people 1.4% represents. No Australian impact has been reported. UPDATE 19 October 2026 (BleepingComputer, 19 Oct): OpenCode's email to affected users says the external-provider API keys they had linked to OpenCode Console were exposed, with the earliest possible exposure at 00:30 UTC on 17 October (8:30 am Perth), and that no other data appears to have been exposed. Co-founder Dax Raad said attackers using AI agents had targeted OpenCode's systems for at least 48 hours. Affected users reported unauthorised API charges ranging from several hundred US dollars to about US$1,700 overnight, and some said Google suspended their Google Cloud projects for 'abusive activity consistent with hijacked resources'. OpenCode says it is working with Google, OpenAI and Anthropic, and its email raises the possibility of reimbursement. Correction (22 Oct 2026): removed an unconfirmed claim about OpenAI key revocation and refunds that rested only on a third-party forum post.
OpenCode (official X account) — security breach affecting 1.4% of OpenCode Console users (17 Oct 2026)
Australian cosmetics brand Napoleon Perdis has emailed customers to say a third party it used to store customer records, Retail Express, was hit by a cyber attack. According to the email, reported by the ABC on 17 October 2026, Napoleon Perdis was told in June, and in August 2026 Retail Express confirmed that an unauthorised party had access between November 2025 and June 2026, affecting approximately 339,055 customer records. The affected records belong to customers from before June 2025. Information accessed includes names, dates of birth, email addresses, phone numbers, postal addresses and purchase histories. The company says the system did not hold bank account or card details or napoleonperdis.com account passwords, that the incident has been contained and the system permanently shut down, and that its current online store was not affected. The Office of the Australian Information Commissioner has been notified. Napoleon Perdis warns customers to watch for scam calls or emails impersonating the brand and to monitor bank transactions. Context: on 9 June 2026 Cyber Daily reported that the forum actor known as 2019 had listed Napoleon Perdis and claimed 339,100 customer records (including loyalty points, transaction history and spending totals), released free on a hacking forum; the company had not confirmed that claim at the time. (source: ABC News, reporting Napoleon Perdis's customer email)
ABC News — Napoleon Perdis data breach affects 340,000 of the cosmetics company's clients (17 Oct 2026, quoting the customer email)
Lightning AI's security incident notice says that on 15 October at 11:00 PM UTC it identified a security incident on the Lightning Platform involving unauthorized access to credentials, and that it revoked all user access to the platform on 16 October at 1:00 AM UTC. Lightning says the incident involves Lightning Studio Platform services such as Studio, Deployments, Pipelines and Drive, and not the GPU cluster rental infrastructure or managed services like Kubernetes and SLURM. Lightning says it believes certain customer credentials were compromised to gain access to environments and connected third-party services, that it has revoked all identified credentials used in the incident, and that it is working with an independent external cybersecurity firm. Lightning says customers identified as potentially affected to date have been notified, and that users who have not received a notification have not been identified as affected based on its investigation to date. The notice itself carries no date; Lightning's status page first reported emergency maintenance at 03:08 UTC on 16 October, linked the notice at 20:34 UTC that day, last updated the incident at 12:49 UTC on 19 October, and still listed it as unresolved ('Service is down to address a security incident') when checked on 26 October (Perth).
Lightning AI — October 2026 Security Incident (undated notice; linked from Lightning's status page 16 Oct 2026, 20:34 UTC)
The California Department of Education (CDE) said on 16 October 2026 that ETS, the nonprofit assessment organisation that runs California's statewide student assessments (CAASPP and ELPAC), has begun notifying students and families of a data breach. According to the ETS notice published by CDE, ETS found unauthorised activity on 25 September on a secure file transfer protocol (SFTP) site used to exchange statewide assessment information with CDE; an unauthorised party had used a compromised login credential at various times between 22 May and 18 September 2026 to copy files of California student information. Data on all students enrolled in the three previous school years was accessed and copied, as well as some former students, and may include names, dates of birth, home addresses, schools, districts and grade levels, statewide and local student identifiers, gender, race or ethnicity, primary language, country of origin and English learner status, disability and Section 504 status, assessment accommodations and primary disability type, eligibility for Title I, McKinney-Vento (homeless) and military-connected programs, and English proficiency and assessment results. More than 5.7 million students were enrolled in California in the 2025 school year. Social Security numbers, licence and passport numbers, financial and card details, passwords and parent or guardian information were not involved. ETS disabled the account, took the SFTP site offline and built a new one, paused normal enrolment data processing and some assessment activities, and says it has taken steps with law enforcement and cybersecurity experts to reduce the risk of the data being published and has found no sign so far that it has been. No group has claimed the attack. Notices began on 16 October and will continue into early November, in 27 languages, with two years of free Experian IdentityWorks identity protection. CDE says it is reviewing ETS's compliance with its data-security and contract requirements. (sources: CDE news release; The Record) Updated 20 Oct 2026 (The Record): The Record's report is dated 20 October 2026; details credited to The Record on this card come from that report.
California Department of Education — ETS begins notifying California students and families following data security incident (16 Oct 2026)
Russia's federal education supervisor Rosobrnadzor said on 19 October 2026 that it had restored its online systems after a cyberattack on its resources and those of the Federal Institute for Education Quality Assessment (FIOKO), its subordinate body that runs national education-quality testing. During the attack on Friday 16 October, students answering questionnaires on the Edutest assessment platform were shown messages urging them to join an underground movement against President Vladimir Putin instead of the next question, and assessments at schools and vocational colleges across the country were suspended. The disruption hit a major stage of the programme, which runs from 12 to 29 October, when 9th-grade students in 29 regions were due to sit questionnaires; the results rate institutions, not individual students. A pro-Ukrainian group calling itself Black Spark claimed responsibility on Telegram and denied trying to recruit minors. Rosobrnadzor has not said how the attackers got in or whether any data was taken. (sources: Rosobrnadzor statement; The Record)
Rosobrnadzor — statement on restoration of online resources after the attack (MAX channel, 19 Oct 2026; Russian)
Nikkei Inc. said on 16 October 2026 that a cloud service it uses for system development was accessed without authorisation and that, as of 16 October, about 1.83 million items of personal information had leaked. About 150,000 items contained at least one of name, email address, postal address, phone number or date of birth, and about 120,000 of those included an email address. The other roughly 1.68 million items held only identifiers that cannot identify a person on their own. No credit card information was involved. Nikkei says the credentials used were stolen by unknown means, the access took place from the early hours to the morning of 7 October, and personal information stored in the cloud was taken. It has disabled the credentials, reported the incident to Japan's Personal Information Protection Commission on 11 October, and will contact each person whose information is confirmed to have leaked. As of 16 October it had found no misuse of the data, no system outages and no data tampering. Nikkei has not named the cloud service or an attacker. This is a separate incident from the hijacked Microsoft 365 account that sent about 9,000 phishing emails on 30 September and the earlier Google Workspace account compromise, both covered on Cyberstack (/n/nikkei-m365-email-phish-breach-20261004); Nikkei has not said whether they are connected. (sources: Nikkei Inc. notice; BleepingComputer) Updated 19 Oct 2026 (BleepingComputer): BleepingComputer's report is dated 19 October 2026; details credited to BleepingComputer on this card come from that report.
Nikkei Inc. — Personal Information Leak Due to Unauthorized Access (16 Oct 2026)
Anthropic published research on 16 October 2026 saying an internal Claude research model worked out, in under half an hour, how the unexplained 'seed' values behind the NIST elliptic curves P-192, P-224, P-256, P-384 and P-521 were produced. The seeds, supplied by the NSA and published in FIPS 186-2 in 2000 without explanation, have long fuelled suspicion that the curves could have been chosen with a hidden weakness. According to Anthropic, they were not hashes of a forgotten phrase, as the long-told story went, but successive 20-byte outputs of the POSIX 48-bit rand48 pseudorandom generator seeded with the then-current Unix time. Each prime-curve run dates to between May 1997 and April 1998; for example P-256 is the 1,842nd candidate from a run seeded at 01:52:34 UTC on 16 August 1997. Claude spotted a statistical fingerprint in the top bits of some seeds, recovered the generator state with LLL lattice reduction, and stepped it back to a timestamp; the same method explained five ANSI X9.62 example-curve seeds and, if the clock was halved, four binary-curve seeds. It also traced the base points of P-192 and five X9.62 curves to the FreeLIP library's generator. Filippo Valsorda, who ran the NIST Elliptic Curves Seeds Bounty, re-implemented the method in Go, confirmed it (he describes the drand48 variant of the same generator family) and says the Anthropic team claimed the bounty on 15 October; the US$36,864 is being donated to ISRG, which runs Let's Encrypt. He argues the finding rules out the 2017 Bernstein–Lange idea of using seed freedom to aim at a hidden class of weak curves, since the generation leaves roughly 30 bits of choice at most. Still unexplained: why some valid candidates were skipped (P-256's own run produced a usable curve at candidate 876), the B-163 seed, and the base points of P-224, P-256, P-384 and P-521. Anthropic and Valsorda both say this is not a break or weakness in the curves and nothing needs to change. (sources: Anthropic; Filippo Valsorda)
Anthropic — Claude reveals ECDSA curve origins (16 Oct 2026)
Rank Math, maker of the widely used Rank Math SEO plugin for WordPress, published a security incident notice on 16 October 2026 (UTC) saying that some copies of its paid Rank Math PRO plugin, version 3.0.123, contained malware. Only packages downloaded, or installed through an update, between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026 are affected (about 4:02 am to 3:12 pm on 16 October in Perth). Having version 3.0.123 does not by itself mean a site was compromised. Rank Math removed the affected files and released a clean version, 3.0.124. Wordfence assigned CVE-2026-111862 and rated it CVSS 9.8; Patchstack lists it as a backdoor, published 17 October. If the plugin was activated, the malicious code could set up persistent access and rebuild a hidden backdoor whenever someone visited the site, so deactivating the plugin is not enough. Rank Math warns that WordPress passwords, database credentials, API keys and other secrets the web server can read should be treated as exposed. Indicators from the notice: outbound connections to rank1cdn[.]com; wp_options entries named _uf6qdn2hmm, t8krdk990phb or _np5pvf754c; administrator accounts whose usernames start with wpsupport_ or that use @wp-mail[.]net email addresses; PHP files in the inc/, includes/ or lib/ folders of non-default themes containing base64_decode with XOR loops, the key xmmqhn, proc_open or PHP-FPM socket code; a fake WordPress core file; .htaccess rules that make .cache files run as PHP; and a web-server-user crontab entry tagged #ms6v46. Rank Math has not said how its distribution was tampered with or how many sites received the affected package. The free Rank Math SEO plugin on WordPress.org is not named in the notice. UPDATE (19 Oct, BleepingComputer): BleepingComputer found a PHP malware sample on VirusTotal, named 'cache-preloader-fff033 (1).php', that carries the same indicators as Rank Math's notice, including code that creates administrator accounts with the wpsupport_ prefix and @wp-mail[.]net addresses. It appears to be a first-stage script that drops the wp-includes/class-wp-cache-util.php backdoor named in the advisory, and it can also run commands, change the WordPress database and steal AWS, Cloudflare, Google Cloud and Azure credentials and SSH keys. BleepingComputer could not confirm that this file was delivered through the compromised plugin. Rank Math has not answered questions about how many sites were affected or how the attackers got in.
Rank Math — PRO 3.0.123 security incident: how to secure your website (16 Oct 2026, updated 17 Oct)
ConnectWise says it found unauthorised access to application identities in its Cloud Backup environment (the Microsoft 365 and Google Workspace backup service for MSPs, formerly SkyKick). Its Trust Center advisory, first posted 16 October 2026 and updated 17 October 05:01 UTC, says it has shut off Cloud Backup application access as a protective step, which interrupts backups until further notice; it has no indication so far that partner backup data was compromised and the existing backup archive is not affected. Huntress, which found the activity, says the app's Microsoft 365 credential (API secret) is in an attacker's hands: on 15 October between 06:13 and 08:34 UTC it was used from 144.172.64[.]128, a hosting-provider address, to obtain Microsoft Graph tokens in customer tenants, moving through tenants in sorted order a few seconds apart, which points to a script. As of 19:00 UTC on 16 October Huntress had confirmed unauthorised sign-ins in 162 tenants, and says the credential works in every tenant where the app is consented, so any organisation with it installed is exposed. The app's consent covers mail and attachments, OneDrive and SharePoint files, Teams chats and directory data, and some directory reads leave no audit trail. Huntress also saw the same IP password-spraying four law-firm tenants on 13 and 14 October, and in one tenant a ConnectWise Cloud Management app for Teams added itself to Global Administrator and added new secrets to an MSP management app and Huntress's own app; it has not tied that earlier activity to the same operator. Todyl separately reported the same Graph sign-ins and notes that revoking user sessions does not end app access. No country breakdown has been published. (sources: ConnectWise Trust Center advisory; Huntress; The Hacker News) UPDATE 17 October (ConnectWise, 17:00 UTC): ConnectWise says it suspended the Cloud Backup service by revoking the certificates used for the affected application connections for all users, so the shared credentials previously used for Cloud Backup are no longer valid. It has brought in an outside incident response firm, has not seen successful threat activity in the environments it monitors since the mitigations, and has no evidence that the encrypted backup archives were accessed; archives are preserved but backup and restore remain unavailable until service is restored. ConnectWise says Cloud Backup gives it no visibility into partner and customer tenants, so it cannot tell whether a given Microsoft 365 tenant saw unauthorised activity; partners must check their own. UPDATE 17 October (Huntress, 21:15 UTC): Huntress now counts almost 1,000 Entra tenants with sign-in activity from 144.172.64[.]128, more than 300 of them successful, although tenants without the app's service principal could not be accessed. It also found a second, targeted wave on 15 October against 16 tenants in the policy, national security, trade and critical-minerals sectors, most of which do not use ConnectWise products; an automated sweep for Graph tokens (09:25 to 12:35 UTC) was followed by what looked like a manual sweep (13:54 to 14:20 UTC) aimed at Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra and the Office 365 Management APIs, and failed where the app was not present. The credential added to a Huntress application in one tenant came from private Azure IPv6 space rather than the earlier IP. Huntress has received unverified outside reports of similar, apparently hands-on activity in other tenants. UPDATE 18 October (ConnectWise, 01:00 UTC): ConnectWise says it first identified the issue on 14 October and at 07:00 UTC on 17 October disabled seven of its application identities: ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae) and six ConnectWise Cloud Management apps, the base app (2399d300-6fca-4e6a-a686-399fefe75b83) plus MS Teams (24205314-2b89-4e07-a2a4-579e898a5640), Exchange Online (b78f6a77-d4e5-46fb-87e5-d1648bd02519), MS Graph (0de14c77-b9b0-4137-9360-34878a929827), Partner Center (412dcf96-176d-4b3a-a1b0-4981ad66971e) and SharePoint Online (b2b55f5b-7758-4719-8d8f-88ae172e6bdb). It stresses that disabling them stops new sign-ins through those connections but does not undo changes already made inside a tenant, that previously issued access tokens may stay usable until they expire, and that any credentials, roles or consents an attacker added through other identities need separate clean-up. As a further precaution it has taken SaaS Security (monitoring and alerting) and Cloud Management (user and licence management) offline; Cloud Backup stays suspended with no restoration time, scheduled backups are not running and archives cannot be restored, though ConnectWise says they remain encrypted and it has no evidence they were accessed. It has engaged an outside forensics firm and says it has not yet established whether a product vulnerability was involved; how the credential was exposed is still under investigation. Huntress told The Hacker News it last saw malicious sign-ins from the original IP at 08:45 UTC on 15 October, with targeted manual activity until about 14:20 UTC, and has confirmed abuse of the Cloud Management Teams app in one tenant. UPDATE 18 October (ConnectWise, 18:45 UTC; 19 Oct 02:45 Perth): ConnectWise lists two further attacker IP addresses, 144.172.64[.]99 and 144.172.64[.]60, shared through downstream monitoring of partner and customer environments, alongside the original 144.172.64[.]128, and asks partners to include all three when reviewing Microsoft 365 sign-in and audit logs. Its 16:00 UTC update reported no new confirmed findings; Cloud Backup, SaaS Security and Cloud Management stay suspended, archives remain encrypted and isolated with no sign of compromise, and ConnectWise says that finding does not establish whether individual live tenants were affected. iTnews (19 Oct) reports that the rogue secrets added to the MSP management app and Huntress's app in the one tenant were both set to remain valid until 2028, which would have allowed a return after ConnectWise's own credential was cancelled; Huntress says it found and removed the credential on its app on 16 October. UPDATE 19 October (ConnectWise, 13:45 UTC; 21:45 Perth): ConnectWise says it has not seen successful threat activity in the environments it monitors since 17 October 05:00 UTC (1:00 pm Perth), with containment measures still in place. Cloud Backup, SaaS Security and Cloud Management remain suspended, scheduled backups, archive access and restores are still unavailable, and there is no confirmed restoration time; it will publish a timeline and any reconnection instructions once confirmed. It asks partners who serve customers through a reseller, distributor or marketplace to make sure the administrator of each customer tenant receives and acts on its remediation guidance. UPDATE 19 October (Huntress, 1:30 pm ET / 17:30 UTC; 1:30 am Perth 20 Oct): reviewing application sign-ins across more than 10,000 tenants with ConnectWise apps where it can see logs, Huntress says only 144.172.64[.]128 and Microsoft-internal ranges produced application sign-ins. The other circulating addresses in the same provider range (AS14956, RouterHosting) showed only failed user logins or password spraying, which Huntress does not currently link to the app sign-ins: 144.172.64[.]99 (concentrated spray, 10–14 Oct), 144.172.64[.]60 (a few failed logins, 18 Oct) and 144.172.94[.]243 (broad, ongoing spray against many organisations). Huntress has found a second tenant with post-compromise activity. In both tenants the actions ran within two minutes of each other at about 03:45 UTC on 15 October (11:45 am Perth): the ConnectWise application granted itself Global Administrator, then planted new secrets on a few other applications registered in the tenant, apparently chosen at random and often low-privilege ones, to keep a foothold. Huntress found no mailbox or file tampering or user or policy changes in those two tenants, but notes Microsoft Graph directory reads leave no audit record. The last confirmed successful sign-in with the stolen credential was at 08:44 UTC on 15 October (4:44 pm Perth); since then it has seen only failed attempts. UPDATE 19 October (ConnectWise, 18:50 UTC; 2:50 am Perth 20 Oct): containment remains in place with no successful threat activity seen since 17 October 05:00 UTC; ConnectWise says it is monitoring its entire environment and sees no indication of impact beyond Cloud Backup and the precautionary suspensions of SaaS Security and Cloud Management, all three of which remain suspended with no restoration time yet. It has published a video walkthrough of its Cloud Backup technical investigation and remediation guide, and repeats that affected applications must stay disabled until it issues formal restoration instructions. UPDATE 20 October (ConnectWise, 00:45 UTC; 8:45 am Perth): ConnectWise says it has strengthened administrative-access protections and is resetting accounts and replacing application credentials in the affected environment, with third-party forensics still validating remediation; existing Cloud Backup archives remain encrypted, isolated and preserved with no indication they were compromised, though it stresses this does not show whether live Microsoft 365 tenants were affected, so each tenant still needs review. Services will come back in controlled phases, with partner instructions issued before anything is re-enabled; no restoration time yet, and the next update is due by 13:00 UTC on 20 October (9:00 pm Perth). UPDATE 20 October (ConnectWise, 13:01 UTC and 19:05 UTC; 9:01 pm 20 Oct and 3:05 am 21 Oct Perth): ConnectWise says it completed a full reset of all accounts and credentials in the affected Cloud Backup environment on 19 October and is finishing security validation before restoring services in controlled phases, core infrastructure first, with extra review of the most sensitive connections. Once restoration starts it expects it to take several days; it will give a firmer timeline after the first full day of restoration work and will issue instructions before partners need to re-enable connections. Cloud Backup, SaaS Security and Cloud Management stay suspended, so scheduled backups, archive access, restores, SaaS Security alerting and Cloud Management user and licence management are still unavailable. It is still working with outside specialists to find how the access first happened and its full scope, sees no impact on other ConnectWise products, and has started partner technical webinars every two hours from 18:00 UTC on 20 October (2:00 am Perth 21 Oct) walking through Entra ID sign-in and audit logs, app registrations, credentials and permissions, including legacy backup integrations. UPDATE 21 October (ConnectWise status page, 14:35 UTC; 10:35 pm Perth): ConnectWise says it has begun restoring services in controlled phases after remediation and security validation, with each restoration step subject to security review, and expects restoration to take several days; it says service will return in stages and the start of restoration does not mean all capabilities are available. It will publish step-by-step instructions on when and how partners should reconnect affected services, including any reauthorisation and verification steps, and says partners should keep affected application connections disabled until then. Its investigation continues alongside restoration; existing backup archives remain encrypted, isolated and preserved with no indication of compromise, which it says does not establish whether individual partner or customer Microsoft 365 environments were affected, and it sees no indication that other ConnectWise products are impacted. Next update due by 19:00 UTC on 21 October (3:00 am Perth 22 Oct). UPDATE 22 October (ConnectWise status page, 00:52 UTC; 8:52 am Perth): ConnectWise says phased restoration is underway, with each step subject to security validation, and still expects restoration to take several days; partners should keep affected connections disabled until formal instructions apply to their service. It says existing backup archives remain encrypted, isolated and preserved with no indication of compromise, that it has no indication other ConnectWise products, services or offerings are impacted by this incident, and that individual Microsoft 365 tenants still require review for unauthorised changes or persistent access. ConnectWise says that beginning 22 October it will publish updates twice daily. UPDATE 22 October (attribution): In a Trust Center update at 22:00 UTC on 21 October (6:00 am Perth 22 Oct), ConnectWise says that, based on the evidence available to it, including threat intelligence shared by Microsoft, it appears that a China state-aligned group was responsible for the attack on Cloud Backup, and that the group used an openly available agentic AI framework to automate and speed up its operation; ConnectWise says its containment and phased restoration do not remove unauthorised access that may already have been established within individual customer tenants, which require separate review. In a Microsoft Security Blog post (21 Oct, 18:23 UTC; 2:23 am Perth 22 Oct), Microsoft assesses that Storm-0940, a China-state aligned actor active since 2021, was responsible for the ConnectWise supply chain compromise, and says the actor used ARTEX, an agentic AI penetration testing framework, to accelerate scanning and reconnaissance, password spraying and OAuth application abuse at downstream victims. Microsoft says that following the unauthorised access Storm-0940 used ARTEX to attempt to sign in to more than 2,250 tenants at 2,900 sign-in attempts per minute, and that in some environments the agents progressed to Microsoft Graph and directory operations, including reconnaissance, application credential modifications to establish persistence, and changes involving identities, groups and privileged roles, which Microsoft warns can remain active as a backdoor. Microsoft also says Storm-0940 infrastructure at 144.172.64.99 ran a cross-tenant password-spray campaign against 327 accounts across eight organisations between 10 and 14 October in which no successful authentication was observed, that the presence of an affected application or a successful sign-in does not necessarily mean customer data was accessed or exfiltrated, and that the activity did not result from a compromise of or vulnerability in Microsoft corporate systems, products or services. UPDATE 23 October (ConnectWise status page, 01:11 UTC; 9:11 am Perth): ConnectWise says service restoration work is progressing and it anticipates completing testing and security validation of the restored environment by the end of this weekend, which, subject to successful completion, will let it begin returning capabilities to partners in phases: first a process for partners who need to restore data from existing backups, which it currently anticipates enabling early next week, then phased full-service re-enrolment with step-by-step instructions. Partners should keep affected application connections disabled until ConnectWise provides instructions that apply to their service. ConnectWise says that starting 23 October it will move to once-daily updates. Updated 23 Oct 2026 (ConnectWise Trust Center, 14:00 UTC; 10:00 pm Perth): ConnectWise says its teams and independent specialists are continuing restoration testing and security validation, which it expects to complete by the end of the weekend; it then anticipates enabling a process for partners to restore data from existing backups early next week, followed by phased re-enrolment supported by step-by-step instructions, video tutorials and webinars. Partners should keep affected application connections disabled until ConnectWise gives instructions for their service; existing backup archives remain encrypted, isolated and preserved with no indication of compromise; and ConnectWise will publish updates once daily at 14:00 UTC. (source: ConnectWise) Updated 24 Oct 2026 (ConnectWise Trust Center, 14:00 UTC; 10:00 pm Perth): ConnectWise says services are being brought back online in a controlled sequence, including rotating certificates across its infrastructure, with restoration, testing and security validation continuing through the weekend and a target of beginning phased partner onboarding on Monday 26 October, subject to the required checks. It anticipates enabling backup restoration for partners on Monday, followed by phased re-enrolment, and says bringing infrastructure online does not mean all partner capabilities are available. Existing backup archives "remain encrypted, isolated and preserved, with no indication of compromise", and it has no indication that other ConnectWise products, services or offerings are impacted. (source: ConnectWise) Correction (24 Oct 2026): an earlier version said The Hacker News reported 173 affected tenants on 17 October; The Hacker News's article is dated 18 October and does not give that figure, so it has been removed. (source: The Hacker News) Updated 28 Oct 2026 (ConnectWise status page, 17:09 UTC; 1:09 am 29 Oct Perth): ConnectWise says it is beginning phased restoration, starting with Microsoft 365 backups and restores through a new, security-hardened application, with other features returning in phases over the coming days. Partners must re-authorize each Microsoft 365 tenant using the new application, 'ConnectWise Cloud Backup for M365', to resume backup and restore operations, following the instructions on the ConnectWise Trust Center. (source: ConnectWise)
ConnectWise Trust Center — Cloud Backup (formerly SkyKick) service interruption advisory (16–18 Oct 2026)
