ConnectWise breached and more - October 18, 2026

Featured

ConnectWise has confirmed they were victim of a data breach

Attackers breached Microsoft 365 tenants through compromised Cloud Backup application identities

This Week’s Updates

Breaches

Daiichi Kosho confirms malware at contractor Nippon Columbia exposed 8.6 million karaoke app customer and employee records

Ahold Delhaize confirms cyberattack forced it to take systems offline

Intermarché and Coopérative U confirm a cyberattack knocked out refrigeration systems at French supermarkets

Ledger confirms a hardware implant in devices sold by a reseller drained customers' crypto wallets

TFG London confirms a cyberattack disrupted IT systems at its Hobbs and Whistles retail brands

UK Legal Aid Agency confirms stolen records from its 2025 breach date back to 1978

BAE Systems confirms a cyberattack took down the US federal bankruptcy court notice system

Burger King Japan confirms a breach of its app exposed 11 million customer records

Vulnerabilities

GitLab patches maximum-severity CVE-2026-97229 flaw letting unauthenticated attackers execute code on self-managed servers

SAP patches maximum-severity CVE-2026-89111 SSRF flaw in its Cloud SDK for Python that exposed OAuth2 credentials

Docker patches CVE-2026-105445 flaw that let attackers impersonate Docker Hub users and tamper with images

Ivanti patches actively exploited CVE-2026-104935 authentication bypass zero-day in Connect Secure

Ghostscript fixes CVE-2026-39919 heap overflow that let crafted PDF uploads hijack servers

Cisco patches actively exploited CVE-2026-76519 zero-day in Secure Email Gateway allowing root command execution

Palo Alto Networks patches actively exploited CVE-2026-0322 RCE zero-day in the PAN-OS management interface

Attackers exploit patched CVE-2026-110447 Collabora RCE flaw to backdoor Nextcloud servers

BeyondTrust patches CVE-2026-102764 Remote Support zero-day exploited since August by suspected China-nexus hackers

Adobe patches maximum-severity CVE-2026-103849 BlockStrap flaw in Magento and Adobe Commerce ahead of expected attacks

Drupal patches two critical RCE flaws, CVE-2026-108097 and CVE-2026-108099, affecting all supported core versions