This brief covers October 17–19, 2026. It is a quieter window, and items are drawn from vendor and researcher primary sources, with outlet reporting linked alongside.
ConnectWise disables application identities after Microsoft 365 tenants compromised
ConnectWise · October 17, 2026
Unknown actors obtained unauthorized access to ConnectWise application identities and used them to sign in to customer Microsoft 365 tenants. ConnectWise says it first identified the issue on October 14, disabled seven application identities at 07:00 UTC on October 17, suspended Cloud Backup by revoking certificates, and took SaaS Security and Cloud Management offline. Huntress observed sign-in activity from the associated IP address against almost 1,000 Entra tenants, about 300 of them successful. Disabling the connections blocks new authentication but does not undo changes already made inside a tenant. No CVE has been assigned, and ConnectWise says it is not yet clear whether a product vulnerability contributed.
“Since implementing these mitigations, we have not observed successful threat activity in the environments we monitor.”
— ConnectWise advisory update, as quoted by The Hacker News
Source: The Hacker News · BleepingComputer · ConnectWise status page
OpenCode Console breach may have exposed customers’ OpenAI, Anthropic and Google API keys
OpenCode · October 17, 2026
An intruder reached a legacy system in OpenCode’s hosted Console, where workspaces store their own third-party provider keys. OpenCode emailed affected users on October 17; it says keys “may have been exposed” for about 1.4% of Console users and has not confirmed any were copied. Keys stored locally by the CLI and desktop apps are reportedly not affected. Some users report unauthorized provider charges, but those are individual claims. No CVE applies. Anyone with a provider key saved in the Console should rotate it. Vendor wording is as relayed by The Hacker News; the original X posts were not independently retrieved.
“Action Required: Potential provider key breach.”
— OpenCode notification email subject, as reported by The Hacker News
Source: The Hacker News · OpenCode on X
Still developing
SiteGuard Server Edition WAF command injection exploited in the wild (CVE-2026-106931)
JPCERT/CC (JVN) · October 14, 2026 · widely reported October 18
OS command injection (CWE-78) in SiteGuard Server Edition 2.20 and later, when the statistics function is enabled (the default). JVN scores it CVSS v4.0 8.5 and v3.0 7.8 and states exploitation in the wild has been confirmed; successful abuse runs commands as root or SYSTEM. Fixed in 8.00 Update 5 (Apache, Nginx, IIS) and 7.00 Update 6 (FreeBSD), with a file-replacement patch for versions that cannot be upgraded. The vendor advises downloading diagnostic information before patching, since remediation can erase attack traces. No KEV entry was confirmed in the sources reviewed.
“Abuse has already been confirmed.”
— SiteGuard vendor alert, as quoted by BleepingComputer
Source: JVN · SiteGuard alert · BleepingComputer
Drupal core and Entity List RCE flaws patched; exploits expected soon (CVE-2026-108097, CVE-2026-108099)
Drupal Security Team · October 14, 2026 · reported October 17
SA-CORE-2026-014 (CVE-2026-108097) is rated “Critical 19/25” by Drupal and affects core 8.9.0 through releases before 10.6.19, 11.3.19 and 11.4.10, plus Drupal 12 pre-releases before beta2. Drupal says core alone is not directly exploitable but serious exploit paths exist through contributed modules, one requiring no authentication. A companion Entity List module flaw, CVE-2026-108099, is fixed in 3.0.10. Drupal publishes no CVSS score for the core flaw, and no in-the-wild exploitation has been confirmed. Uninstalling the Field UI module is the stopgap if you cannot upgrade.
“At least one known exploit path does not require authentication.”
— Drupal SA-CORE-2026-014
Source: Drupal SA-CORE-2026-014 · SA-CONTRIB-2026-218 · BleepingComputer
Unpatched Broadcom WPS flaw allows root code execution from Wi-Fi range
Quentin Kaiser · October 16, 2026 · reported October 19
A long-standing bug in Broadcom’s proprietary WPS implementation lets an unauthenticated attacker in radio range leak memory and execute code without the network key. Affected chips include BCM3380, BCM3383 and BCM33834 (eCos) and BCM3390, BCM65xx and BCM68xx (Linux). Broadcom would not assign a CVE, none of the devices the researcher tested were patched, and no real-world exploitation has been reported. Replacement of unpatched hardware is the practical mitigation.
“Yet they refused to assign a CVE to this vulnerability or to communicate publicly about it”
— Quentin Kaiser
Source: Quentin Kaiser · The Hacker News
This brief covers the trailing ~48 hours (October 17–19, 2026).
Primary sources: