The breachpocalypse is here
2026-10-26T20:51:32Z•b3b29534866cd273cfd26e2331415060db7570e6145656b78c6e9e45c570e5bd
CVE-2026-109618CVE-2026-109619AI-assisted-attacksBRONZE-SANDCASTLEDLL-sideloadingEntra-IDMeterpreterMicrosoft-GraphPHPServiceNow-enumerationcross-tenant-abuseidentity-intrusionincident-responseproof-of-concepttoken-theftvulnerability-exploitationweb-application-security
What happened
Sophos news feed covering emerging cyber threats, including proof-of-concept exploitation of PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, AI-assisted web application intrusion chains, BRONZE SANDCASTLE activity using DLL sideloading and modified Meterpreter shells, identity reconnaissance, and abuse of a ConnectWise Cloud Backup Entra application to obtain Microsoft Graph tokens across tenants.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sophos_news
- Record identifier
- b3b29534866cd273cfd26e2331415060db7570e6145656b78c6e9e45c570e5bd
- Enrichment time
- 2026-10-26T20:51:32Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.