Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
2026-10-18T07:23:21Z•0dc75026476358a2c6b7be0f83291be6ced316dd46e50a674789d19b6513e08d
CVE-2026-103849CVE-2026-110447Adobe-CommerceArch-LinuxBeyondTrustBlockStrapCandiruCollaboraConnectWiseD-LinkDrupalMagentoMicrosoft-365NextcloudUbiquitiWindows-Serveractive-exploitationcloud-securitycritical-vulnerabilitydata-breachmalicious-packagesproxyjackingremote-code-executionspywaresupply-chain-attackzero-clickzero-day
What happened
A BleepingComputer security-news feed covering major 2026 incidents and vulnerabilities, including a ConnectWise Cloud Backup supply-chain compromise affecting Microsoft 365 tenants, critical Drupal, Magento BlockStrap, Collabora/Nextcloud, and BeyondTrust flaws, Candiru spyware zero-click attacks, data breaches, device hijacking, malicious Arch Linux packages, and enterprise security guidance. Several reports describe active exploitation or potentially imminent exploitation of critical remote-code-execution vulnerabilities.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 0dc75026476358a2c6b7be0f83291be6ced316dd46e50a674789d19b6513e08d
- Enrichment time
- 2026-10-18T07:23:21Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.