October 21, 2026

This edition prioritizes access boundaries where a single credential can extend across tenants, outlive revocation, or intersect with known exploitation. It keeps policy, research, and attributed allegations distinct from confirmed operational security events. [1][2][3]

What happened

ConnectWise Cloud Backup customers’ Microsoft 365 applications were compromised after an unidentified threat actor obtained an API secret used to connect the vendor application with Microsoft 365 environments. [1]

The affected Microsoft 365 services included Exchange Online, Microsoft Teams, SharePoint Online, Cloud Backup, Microsoft Graph and Partner Center. [1]

Why it matters

The credential could request access tokens in any tenant where the multi-tenant application was installed, without customer action, and granted technical ability to read and write mail and files. [1]

What happened

Several ransomware groups have exploited CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect, against organizations in healthcare, education, government, and energy. [4]

The flaw affects the GlobalProtect portal and gateway on Palo Alto Networks physical and … [source text truncated]. [4]

Why it matters

The article states that exploitation began in June, while also stating that PAN-OS GlobalProtect was patched in May. [4]

What happened

CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. [3]

The additions include four Plex Media Server vulnerabilities, one SiteGuard Server Edition OS command-injection vulnerability, and one Siemens Software Center uncontrolled-search-path-element vulnerability. [3]

Why it matters

CISA states that these vulnerability types are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. [3]

What happened

Xerj Console API has an authentication-bypass vulnerability, CVE-2026-97406, that can bypass passkey-backed requirements during token issuance. [2]

An attacker with an existing valid Xerj API token can invoke the token-creation endpoint and mint independent successor credentials with the original token’s access levels. [2]

Why it matters

Successor tokens persist after the compromised parent token is revoked because Xerj lacks hierarchical revocation logic, allowing continued access and potential privilege escalation. [2]

What happened

PHP announced an upcoming security release for two critical vulnerabilities, each rated CVSS v4.0 9.2, scheduled for October 21, 2026 at 14:00 UTC. [5]

Public reports have associated CVE-2026-109618 and CVE-2026-109619 with the release, but PHP has not confirmed the identifiers or disclosed technical details, affected versions, or fixed versions. [5]

Why it matters

PHP may release the updates earlier if vulnerability details become public or evidence of active exploitation emerges. [5]

What happened

Nikkei disclosed a breach affecting approximately 1.83 million items of personal information after attackers used previously stolen credentials to access a cloud service used for system development on October 7. [6]

What happened

IQ.Lvbs alleged that attackers repeatedly attempted from October 7 to 14 to steal its NovaSpark driving model, access users’ devices and private driving files, and exploit its sign-in system. [7]

What happened

A 49-year-old Brazilian man sold belongings and traveled 2,000 km to meet “Jéssica,” an online persona he believed was an influencer and potential partner; the persona did not exist as a real woman. [8]