Here are today’s top cybersecurity stories for Monday, October 19, 2026.
Compromised ConnectWise Cloud Backup Credential Opens 173 Microsoft 365 Tenants
Huntress confirmed unauthorized sign-ins in 173 partner and customer tenants. The attacker used the Cloud Backup application’s own credential, so multi-factor authentication played no role. ConnectWise disabled seven application identities on October 17 and reports no evidence of compromised backup data. The Hacker News
Feds Suspect a Ransom Negotiator Ran the ShinyHunters Extortion Site
Krebs on Security reports investigators found executives at two ransomware negotiation firms with unusually close ties to ShinyHunters. One U.S. executive is suspected of helping run the Shinywire site, which listed nearly 100 victims before it went offline on October 16. Canadian executive Edward Dubrovsky was arrested earlier this month, and no U.S. executive has been charged. Krebs on Security
Rank Math PRO Copies Shipped With a Self-Restoring Backdoor
Copies of the paid WordPress plugin downloaded between 20:02 UTC on October 15 and 07:12 UTC on October 16 carried malware. Wordfence assigned CVE-2026-111862 with a 9.8 rating. Version 3.0.124 is clean but does not remove leftover files, administrator accounts, or scheduled tasks. The Hacker News
Microsoft: October Windows Server Updates Break Exchange Sign-In and Mail Flow
Microsoft confirmed the October updates disrupt Outlook on the web sign-in and email delivery on some on-premises Exchange servers. An Endpoint Mapper memory limit of 512 simultaneous calls is the cause. A registry change raising the limit serves as a temporary workaround while Microsoft works on a fix. BleepingComputer
Attackers Exploit SiteGuard WAF Flaw to Run Commands as Root or SYSTEM
CVE-2026-106931 is an OS command injection flaw in the statistics function of SiteGuard Server Edition. SiteGuard confirmed abuse in its own alert, and JPCERT/CC published a warning. Fixed builds are 8.00 Update 5 for most editions and 7.00 Update 6 for FreeBSD. BleepingComputer
Plex2Shell Exploit Chain Installs Crypto Miners and a Linux Proxy Backdoor
Attackers began exploiting four chained Plex Media Server flaws a day after a proof-of-concept appeared on October 16. The chain delivers an XMRig miner and a reverse proxy backdoor. Plex fixed the flaws in version 1.43.3.10861 on August 3. The Hacker News
Compromised Login Exposes Records of Millions of California Students
Educational Testing Service reports an intruder used a stolen credential to copy files from its SFTP site between May 22 and September 18, 2026. The data includes names, birth dates, addresses, and student ID numbers. ETS reports no Social Security numbers or payment data were involved. SecurityWeek
Unpatched Broadcom Wi-Fi Flaw Lets Nearby Attackers Run Code as Root on Routers
Researcher Quentin Kaiser disclosed a Wi-Fi Protected Setup fragment-handling bug dating to at least 2010. Broadcom declined to assign a CVE, and no patch exists. Kaiser estimates millions of gateways are affected, including units from Proximus, Orange Belgium, and VOO. The Hacker News
OpenCode Console Breach Possibly Exposed OpenAI, Anthropic, and Google API Keys
An intruder reached a legacy OpenCode system on October 16. About 1.4 percent of Console users were told to revoke and replace stored provider keys. OpenCode has not confirmed any key was copied or used. The Hacker News
Fake Web3 Accelerator Spreads Malware Through npm and Hijacks AI Agent Traffic
Elastic Security Labs tracks the operation as REF8801. Two packages posing as AI tools for Web3 founders deliver infostealers for Windows and macOS. They also redirect OpenRouter traffic and register a rogue MCP server in agent configurations. The Hacker News
MITRE ATT&CK v20 Adds AI Abuse, MFA Bypass, and Water Utility Attacks
The release adds 15 detection strategies backed by 38 analytics. New content covers prompt injection, AI agent abuse, application-specific password theft, and a campaign against more than 30 Minnesota water utilities. SecurityWeek
Stay tuned for today’s in-depth analysis posts.
