The Signal
Today’s priority is security-boundary failure: delegated cloud identity, nearby radio access, guest-host separation, and local kernel protections all merit more weight than adjacent developments. The selected research and reported surveillance remain distinct from confirmed operational compromise. [1][2][3][4][5]
Must Know
Cloud · Securityaffairs
What happened
Unknown attackers obtained unauthorized access to seven ConnectWise application identities associated with Cloud Backup, prompting suspension of Cloud Backup and taking SaaS Security and Cloud Management offline. [1]
The stolen application credentials could let attackers impersonate ConnectWise applications, obtain Microsoft Entra ID access tokens, and—depending on permissions—access mailboxes, SharePoint documents, Teams messages, and directory data without stealing customer passwords. [1]
Why it matters
Disabling affected connections blocks new authentication but does not reverse prior tenant changes; attackers may have added credentials to trusted applications or created applications with permissions, providing access independent of the original vendor credential. [1]
Identity · Securityaffairs
What happened
A Broadcom proprietary 802.11 implementation flaw present in its SDK since at least 2010 can enable unauthenticated remote code execution on affected routers from within Wi-Fi range, without the Wi-Fi password or normal WPS enrollment. [2]
The vulnerability affects WPS EAP reassembly code and can provide controlled information disclosure and arbitrary code execution; a demonstration extracted a router’s Wi-Fi password from memory and transmitted it over Wi-Fi. [2]
Why it matters
The attack does not require user action, and the close antenna placement shown in the laboratory video was not required; the source states that the attack can work over longer distances. [2]
Cloud · Theregister Security
What happened
The article identifies CVE-2026-99999, named PwnEscape, as a critical Linux KVM guest-host escape reportedly triggered by malformed IPv4 packets. [3]
The reported flaw involves guest-controlled checksum metadata influencing a write after packet-header validation; the cited analysis says repeated disclosure could let a guest workload collect information across a security boundary. [3]
Why it matters
The article says violating guest-host isolation could potentially expose other virtual machines, containers, or sensitive host memory, and may enable host code execution or denial of service. [3]
Exploitation · Securityaffairs
What happened
A published exploit for OpenBSD 7.9 chains an inherited signed-16-bit shared-memory counter overflow with a separate kernel out-of-bounds write to achieve local privilege escalation to root. [4]
The exploit bypasses KARL, SMAP and SMEP without requiring an information-disclosure vulnerability; it relies on predictable early-boot allocations and targets known lo0 and enc0 ioctl-handler structures. [4]
Why it matters
The reported exploit provides local attackers a path to root while bypassing multiple kernel and hardware protections, although the report says neither flaw had evidence of in-the-wild exploitation or an assigned CVE at publication. [4]
Research · Cyberscoop
What happened
Researchers from the SHARE Foundation and The Citizen Lab reported that Pegasus spyware targeted University of Belgrade rector Vladan Ðokić, while the spyware affecting prosecutor Rade Bajić has not been identified. [5]
The Citizen Lab reported with high confidence that Ðokić’s device was infected with Pegasus in 2026 through a zero-click exploit requiring no click or file opening. [5]
Why it matters
The reported cases follow a September wave that the SHARE Foundation described as Serbia’s largest documented spyware-surveillance wave, involving 14 people targeted with Pegasus and a newer NoviSpy variant. [5]