ConnectWise Cloud Backup customers’ Microsoft 365 applications were compromised after an unidentified threat actor obtained an API secret used to connect the vendor application with Microsoft 365 environments. The affected Microsoft 365 services included Exchange Online, Microsoft Teams, SharePoint Online, Cloud Backup, Microsoft Graph and Partner Center.
Why it matters
The credential could request access tokens in any tenant where the multi-tenant application was installed, without customer action, and granted technical ability to read and write mail and files.
Known limitation: This item is supported by one source record and has not been independently corroborated here.
Security Daily
Identity · Helpnetsecurity
What happened
Several ransomware groups have exploited CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect, against organizations in healthcare, education, government, and energy. The flaw affects the GlobalProtect portal and gateway on Palo Alto Networks physical and … [source text truncated].
Why it matters
The article states that exploitation began in June, while also stating that PAN-OS GlobalProtect was patched in May.
Known limitation: This item is supported by one source record and has not been independently corroborated here.
Security Daily
Exploitation · Cisa Ncas Current Activity
What happened
CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The additions include four Plex Media Server vulnerabilities, one SiteGuard Server Edition OS command-injection vulnerability, and one Siemens Software Center uncontrolled-search-path-element vulnerability.
Why it matters
CISA states that these vulnerability types are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Known limitation: This item is supported by one source record and has not been independently corroborated here.
Evidence is visible. Uncertainty stays visible too.
Baitaphish separates source records from interpretations, labels AI-assisted enrichment, and avoids turning ingestion volume into unsupported claims about threats, prevalence, or risk.
