Bullhorn takes staffing platform offline to contain cyberattack
2026-10-19T19:23:21Z•709c1fc59b521cb53df5252ae90a0883a80d2dc16b2e3d3927abb4e9d8700b92
CVE-2026-103849API-key-exposureAdobe-CommerceBlockStrapCandiruConnectWiseDrupalKYC-fraudMagentoMicrosoft-365NGINXSiteGuardactive-exploitationcommand-injectioncredential-abusecritical-rcecyberattackdata-breachremote-code-executionspywaresupply-chain-attackvulnerabilityweb-application-securityzero-click
What happened
BleepingComputer security feed covering active cyberattacks, major data breaches, critical vulnerabilities, exploitation of SiteGuard WAF, NGINX and Drupal flaws, a critical Magento/Adobe Commerce BlockStrap RCE (CVE-2026-103849), ConnectWise supply-chain compromise of Microsoft 365 tenants, Candiru zero-click spyware delivery, exposed API keys, and underground KYC fraud services. The most urgent items involve actively exploited command injection and critical remote-code-execution vulnerabilities.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 709c1fc59b521cb53df5252ae90a0883a80d2dc16b2e3d3927abb4e9d8700b92
- Enrichment time
- 2026-10-19T19:23:21Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.