Cyber Risk Brief: 12 - 18 October 2026
CRB-3019 October 2026Sovereign GRC Intel26 min read
Disclaimer:This brief is governance commentary for leadership and risk teams, not incident notification, public attribution, legal advice, or quantitative risk analysis. Threat prioritization, framework mappings, attribution, and risk-zone groupings are informational only. Validate all technical claims against vendor advisories and internal telemetry before operational response.
Threat Intelligence Summary
Eleven rows. T1 and T2 are confirmed Canadian incidents and T3 carries the Canadian marker for CCCS Alert AL26-025; Canadian-marked rows are listed first. T3 to T10 are flaws in CISA KEV: T3 leads as a Canadian-marked row and is due today, T4 to T9 have passed deadlines, and T10 is due today. T9 is a KEV entry whose CVE record was rejected on 16 October, so it has no NVD score. T1, T2 and T11 have no patch and no score: two confirmed incidents and a supply chain compromise.
Bottom line
- What happened. CISA added nine flaws to its Known Exploited Vulnerabilities catalog between 13 and 16 October, across eight products: Ivanti Connect Secure, Windows Shell, PAN-OS, Cisco Secure Email Gateway, AhsayCBS (two), Atlassian Data Center, BeyondTrust Remote Support and Fortinet FortiOS. Separately, a compromised ConnectWise Cloud Backup credential was used to sign in to at least 173 Microsoft 365 tenants that Huntress observed.
- Canadian impact. Pattison Food Group confirmed on 16 October that More Rewards customer data was accessed; the program has more than 3.5 million members and the number affected is not stated. Burnaby School District confirmed a ransomware attack in which files containing personal information were stolen; students' identity and residency documents may be among them. The Canadian Centre for Cyber Security issued Alert AL26-025 on BeyondTrust Remote Support.
- What it means. Several of the exploited products are the devices that control or protect other systems: a remote support appliance, a VPN gateway, two firewall products and an email gateway. The Ivanti chain worked on a fully patched appliance and evaded the vendor's integrity checker, and BeyondTrust was exploited for more than six weeks before its advisory. A patch record is not evidence that a system is clean.
- What to do, by when. Within 24 hours, patch or isolate BeyondTrust Remote Support, Ivanti Connect Secure, PAN-OS, Cisco Secure Email Gateway, AhsayCBS, Atlassian Data Center and the affected Fortinet products, install the October Windows updates, and disable the ConnectWise Cloud Backup and Cloud Management apps in Microsoft 365 while you review their sign-ins. Within 7 days, check each appliance and server for compromise, not only patch status. CISA's deadlines for US federal agencies have passed for seven of the nine flaws, across six products; the other two fall today.
Threat Register
| Threat | |||||
|---|---|---|---|---|---|
T1Confirmed Canadian victim: Pattison Food Group, operator of the More Rewards program used at Save-On-Foods. Discovered 13 October 2026; customers notified 16 October. | More Rewards Loyalty Database Accessed (Pattison Food Group, Save-On-Foods) Pattison Food Group, which runs the More Rewards loyalty program for its Save-On-Foods, Buy-Low Foods, PriceSmart Foods and Nesters stores, says it discovered unauthorized activity on one of its servers on 13 October 2026, shut the server down and brought in a third-party cybersecurity expert. It says it confirmed on Friday 16 October that customers' personal information in the More Rewards database was accessed.
The information accessed is name and, if provided, address, phone number, email address and date of birth. The company says that, based on the information available, passwords, credit card data and transaction history were not accessed and that More Rewards accounts remain secure.
CBC reports that Pattison's website says the program has more than 3.5 million members. The company did not say how many customers are affected, and the sources used do not say how the party reached the server.
Customers were emailed on 16 October. The company says it notified authorities and privacy regulators. CBC asked the Office of the Information and Privacy Commissioner for B.C. whether it had been notified and had no reply by publication. | — | — | High | Post-incident |
T2Confirmed Canadian victim: School District 41 (Burnaby, B.C.). Incident discovered 21 September 2026; notice listing the information that may have been affected updated 14 October. | Burnaby School District: Ransomware Confirmed, Files With Personal Information Stolen This is a repeat. The 28 September brief carried the district with the impact on personal information unconfirmed, and the 5 October brief carried confirmed access, with staff personnel records at risk and no evidence then that sensitive student information was affected. The new facts are in the district's notice, updated 14 October 2026: it calls the incident a ransomware attack, says files containing personal information were copied and stolen, and lists the information that may have been affected. The district discovered the incident on 21 September and reported it to the Burnaby RCMP and the Office of the Information and Privacy Commissioner for B.C.
The notice says affected information may have included: general information about students, parents and guardians for 2024 and 2026, such as names and contact information and the student's Personal Education Number, date of birth, grade, school and, if applicable, Ministry designation; registration forms and supporting documents for students who enrolled in 2024 or 2026, which families may provide to establish residency, such as citizenship or permanent resident documents, visas, or identification, leases or utility bills; kindergarten assessment notes and projections for 2021 to 2025; and lists of students receiving specialized learning assistance or supports, with a brief description and, in some cases, a diagnosis and/or the nature and degree of needs. In a limited and smaller number of cases, the notice says some bus routing information, student intervention records and other student assessments have been affected.
The district says the impact on students, parents and guardians was limited and that most of the sensitive information it holds about them remains secure. Staff were notified on 1 October that information in personnel records had been placed at risk, and TransUnion services were then offered to all staff. On 14 October the district offered students registration with TransUnion's Fraud Alert Database.
CBC reports the district had more than 29,600 students last year. That is enrolment, not a count of affected people; the district has not stated how many are affected or how the party got in. Phone service was restored on 28 September, and MyEducation, including the family portal, on 1 October. The Burnaby RCMP told CBC it is actively investigating. | — | — | High | Post-incident |
T3Canadian Centre for Cyber Security Alert AL26-025 (16 October 2026) covers CVE-2026-102764 and says the Centre has observed open-source reporting of exploitation in the wild. | BeyondTrust Remote Support Authentication Bypass (CVE-2026-102764), CCCS AL26-025 CVE-2026-102764 is an authentication bypass by spoofing (CWE-290) caused by insufficient origin validation in internal messaging components of BeyondTrust Remote Support. The Canadian Centre for Cyber Security says successful exploitation may allow a remote, unauthenticated attacker to perform unauthorized file operations on the appliance without user interaction, which can enable arbitrary file uploads and potentially full compromise. All versions up to 26.2.3 are affected. BeyondTrust scores it CVSS 4.0 9.3.
CISA added it to KEV on 16 October 2026 with a US federal due date of 19 October 2026, the brief's publication date, so the deadline had not passed when this brief was written.
BeyondTrust's timeline, as reported by The Hacker News, has the actor tracked as Armory Castle exploiting it as a zero-day on a single self-hosted appliance on 29 August 2026, the first known exploitation. BleepingComputer describes Armory Castle (formerly UNC5221) as a suspected China-nexus espionage actor tracked by Mandiant and Google Threat Intelligence Group. BeyondTrust says the actor uses a zero-day selectively and, once the flaw is public, typically moves to broad exploitation of every unpatched instance. Mandiant describes a PHP web shell called SAWFLY, a SOCKS5 tunneling tool called BARECLAW, root access gained by a set-user-ID copy of the system shell that gave the actor access to every credential the appliance stored or brokered, attempts to harvest credentials from the appliance's secrets database, remote sessions opened to downstream systems from the appliance's Jump Item list, and deletion of logs.
BeyondTrust had patched its SaaS customers as of 9 October 2026, per the Canadian Centre for Cyber Security and The Hacker News (BleepingComputer gives 8 October). Self-hosted customers on 24.3.1 through 26.2.3 must apply the BT26-05-RS patch manually unless automatic updates are on, and older versions must upgrade first. Shadowserver tracks over 1,400 exposed BeyondTrust remote support instances, per BleepingComputer, which notes it does not say how many are already secured or are honeypots. | Critical | 19 Oct | ||
T4 | Ivanti Connect Secure Authentication Bypass Zero-Day Chain (CVE-2026-104935) CVE-2026-104935 is an authentication bypass by spoofing in Ivanti Connect Secure that lets a remote, unauthenticated attacker execute arbitrary commands. Ivanti scores it CVSS 3.1 8.6 and says it is aware of limited exploitation in the wild. CISA added it to KEV on 13 October 2026 with a US federal due date of 16 October 2026, which has passed.
The Hacker News, citing Volexity, reports that CVE-2026-104935 covers two flaws, an authentication bypass and a remote code execution flaw, and that an actor Volexity tracks as UTA0576 has chained them since 3 October 2026 with a third flaw, a privilege escalation, to run commands as root on an appliance that was fully patched and running 22.8R2.4. BleepingComputer counts the same chain as CVE-2026-104935 plus two other flaws. Defused says its decoys caught exploitation it assesses as CVE-2026-104935 from 1 October. Ivanti has released fixes for two of the three flaws; as of 13 October, Volexity said the fix for the privilege escalation flaw would come in a future release in the coming weeks.
Volexity says the actor deployed no malware or web shell, re-ran the exploit for every command, altered logs, and evaded Ivanti's Integrity Checker Tool. In the incident it investigated, the actor took stored credentials including LDAP domain credentials, searched Active Directory for passwords, and ran password-spraying attacks. The Hacker News's report on CISA's warning, describing Volexity's findings, adds that the actor exfiltrated limited Active Directory metadata, deployed a Kerberos tool capable of Kerberoast attacks, captured LDAP packets and dropped a Python LDAP tool to search for administrator passwords and BitLocker recovery keys. Volexity assesses with low confidence that the motive is criminal, not espionage.
The CVE record lists Connect Secure before 25.1.3.0 as affected. BleepingComputer lists 22.8R2.4 and earlier, 25.1.2.2 and earlier and 25.1.1.1 and earlier, and Shadowserver tracks over 5,500 exposed instances. CISA notes version 22.8 reaches end of life on 31 January 2027. Previdian reported 105 exploitation attempts against its honeypots from 50 IP addresses as of 14 October. | Critical | 16 Oct · passed | ||
T5 | Windows Shell Security Feature Bypass Zero-Day (CVE-2026-96951) Microsoft's October 2026 Patch Tuesday addressed 1,413 vulnerabilities, a record, and one it says has been exploited in the wild: CVE-2026-96951 in Windows Shell. NVD describes improper neutralization of special elements in a command, which lets an unauthorized attacker bypass a security feature over a network. Microsoft scores it CVSS 3.1 8.8.
Microsoft says an attacker who exploits it could evade Mark of the Web defenses. In an email or instant message attack scenario, the attacker could send a specially crafted file and would have to convince the user to take an action, such as clicking a link to the attacker's site. The Hacker News reports it is unclear how the flaw is being exploited, by whom, or against whom.
CISA added it to KEV on 13 October 2026 with a US federal due date of 16 October 2026, which has passed.
CyberScoop, quoting Tenable, says it is the third Windows Shell vulnerability exploited this year. The CISA KEV catalog lists two earlier 2026 Windows Shell entries, CVE-2026-21510 (added 10 February) and CVE-2026-32202 (added 28 April). CyberScoop also reports that 26 Windows Shell vulnerabilities were patched in 2026 through October, against three in 2025. CyberScoop quotes the Zero Day Initiative's Dustin Childs saying only one bug in the release is under active attack. | Critical | 16 Oct · passed | ||
T6 | AhsayCBS Authentication Bypass and Command Injection Chain (CVE-2026-105133, CVE-2026-105134) CVE-2026-105133 is an improper authentication flaw in the AhsayCBS API and CVE-2026-105134 is an OS command injection flaw in its Replication Receiver. The Hacker News, citing Huntress, reports they can be chained for unauthenticated remote code execution. NVD records the scores from the VulDB CNA as CVSS 4.0 5.5 for CVE-2026-105133 and CVSS 4.0 9.3 for CVE-2026-105134. The CVSS and EPSS shown for this row are for CVE-2026-105134.
Huntress observed attackers chaining the two flaws to deploy web shells and XMRig cryptocurrency miners on exposed systems.
The versions released in August 2026, 9.15.2.59 and 10.3.4.0, were assumed to fix the flaws. Ahsay said on 12 October that those versions did not fully address the flaws. It has released hotfixes, AhsayCBS 10.3.4.45 for v10 and 9.15.2.70 for v7, v8 and v9, and says to reboot the server after applying one. Huntress says it independently verified that 10.3.4.45 mitigates the initial entry point.
CISA added both CVEs to KEV on 14 October 2026 with a US federal due date of 17 October 2026, which has passed. | Critical | 17 Oct · passed | ||
T7 | Cisco Secure Email Gateway Arbitrary File Write and Root Command Execution (CVE-2026-76519) CVE-2026-76519 is a relative path traversal flaw in the Advanced Malware Protection feature of Cisco Secure Email Gateway. An unauthenticated, remote attacker can write arbitrary files and run commands as root by sending an email with a crafted attachment through the gateway. It applies when the File Reputation service is enabled and assigned to a mail policy and the Content Scanner Tools version is earlier than 25.3.0.5525. Cisco scores it CVSS 3.1 9.8 and says its PSIRT became aware of active exploitation in October 2026.
CISA added it to KEV on 14 October 2026 with a US federal due date of 17 October 2026, which has passed.
The Hacker News reports the fix has been shipping since 14 September in AsyncOS 15.5.5-014 and 16.5.0-780, in a hardening release whose advisory Cisco updated on 14 October to say the flaw is exploited. The fix also arrives as Content Scanner Tools 25.3.0.5525 or later, which installs without an upgrade or restart. A 16.0 gateway on 16.0.4-302, the build that fixed September's SQL injection flaw CVE-2026-76461, is not fixed for this one. There is no fixed build for 16.0 and no workaround.
Cisco says it contacted Secure Email Cloud customers whose devices showed indicators of possible compromise. The advisory does not say how many devices were attacked or by whom. Shadowserver tracks nearly 300 gateways exposed online, per BleepingComputer, which notes it does not say how many are honeypots or already secured. The Hacker News reports that Cisco also confirmed CVE-2026-76461, a SQL injection flaw in the same gateway, as exploited on 14 September. | Critical | 17 Oct · passed | ||
T8 | Palo Alto Networks PAN-OS Authenticated Remote Code Execution in the Management Interface (CVE-2026-0322) CVE-2026-0322 is a remote code execution flaw in the management interface of PAN-OS. Palo Alto Networks says an authenticated attacker with network access can execute arbitrary code with root privileges on the firewall. It affects PA-Series and VM-Series firewalls and Panorama, virtual and M-Series. Cloud NGFW and Prisma Access are not affected. Palo Alto rates it CVSS 4.0 8.6, High, with a suggested urgency of highest. NVD's own CVSS 3.1 score is 7.2.
Palo Alto says it has observed very limited exploitation targeting the management interface and lists three IP addresses linked to exploit attempts. It does not say who is behind the activity or when it began. Palo Alto says no special configuration is required to be affected and that no known workarounds exist.
CISA added it to KEV on 14 October 2026 with a US federal due date of 17 October 2026, which has passed.
Palo Alto says the risk is highest when the management interface is open to external IP addresses on the internet, and that restricting access to a single jump box reduces the risk. | Critical | 17 Oct · passed | ||
T9 | Atlassian Data Center Arbitrary File Access, CISA KEV (CVE-2026-21589, Record Rejected) Atlassian's advisory of 5 October 2026 describes an arbitrary file access flaw that lets an unauthenticated attacker read specific files in the web application root directory when they know the exact file name and path. It does not allow listing directories. All versions before the fixed releases of Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo and Crowd Data Center, and of Crucible and Fisheye, are affected. Atlassian Cloud was patched, and Atlassian says it found no evidence of exploitation there.
Atlassian rates it Critical, 9.3 on CVSS 4.0, per its own internal assessment. No NVD score exists, because the record is rejected, so no score is shown in the register.
CISA added CVE-2026-21589 to KEV on 15 October 2026 based on evidence of active exploitation, with a US federal due date of 18 October 2026, which has passed.
The identifier is unsettled. The CVE Program record for CVE-2026-21589, issued by Atlassian as the CVE numbering authority, shows REJECTED on 16 October 2026 with the reason that its publication may have been a false positive or a mistake, and NVD shows it as rejected. As of 19 October, CISA's KEV entry and Atlassian's advisory were still live. The sources used do not say whether a replacement identifier will be issued. | — | — | Critical | 18 Oct · passed |
T10 | Fortinet FortiOS Path Traversal Used to Deploy PEERSTITCH (CVE-2025-61624) CVE-2025-61624 is a path traversal flaw in the command line interface of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. An authenticated attacker with an admin profile and at least read-write permissions can write or delete arbitrary files through specific CLI commands. NVD lists Fortinet's CVSS 3.1 score as 6.0; NVD's own CVSS 3.1 score is 6.5. The 5.4 The Hacker News reports matches the temporal score in Fortinet's advisory FG-IR-26-122, which rates the flaw Medium. Fortinet published the advisory and fix on 14 April 2026.
CISA added it to KEV on 16 October 2026 with a US federal due date of 19 October 2026, the brief's publication date, so the deadline had not passed when this brief was written. The sources used do not say who is exploiting it now or how widely.
The Hacker News, citing Palo Alto Networks Unit 42, reports the flaw was used in a prolonged intrusion into a telecommunications managed service provider in September 2024, well before Fortinet's April 2026 fix, to deploy PEERSTITCH, memory-resident ARM64 malware that injects into two FortiOS processes, miglogd and iked, and bypasses checks on tagged VPN sessions. Unit 42 tracks the intrusion as CL-STA-0954 (also known as UNC5820). The malware leaves no persistent binary on disk and opens no listening ports.
Initial access in that intrusion came through a FortiManager flaw, CVE-2024-47575. The attackers took an archive of running configurations, cryptographic material and databases covering more than 500 managed FortiGate firewalls, per The Hacker News. | Critical | 19 Oct | ||
T11 | ConnectWise Cloud Backup Application Credential Abused in Microsoft 365 Tenants ConnectWise says it recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment, formerly SkyKick, and shut off Cloud Backup application access for partners and clients on 17 October 2026. Microsoft says it is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth app of ConnectWise Cloud Backup, and that it saw broad successful service principal authentication from one IP address on 15 October.
The Hacker News, citing Huntress, reports confirmed unauthorized sign-ins in 173 partner and customer tenants. BleepingComputer reported Huntress's earlier figure, from 16 October, of at least 162 compromised tenants in its environment. These are counts Huntress observed, not a total. BleepingComputer says the victim count, the extent of data theft and the method the attacker used to obtain the vendor credential remain unclear.
Huntress also linked the attacker's IP address to sign-in attempts on 13 and 14 October: password spraying against four law firm tenants, with no successful user sign-ins detected, per The Hacker News and BleepingComputer.
The app holds broad permissions, including read and write access to mail, OneDrive and SharePoint files, Teams and directory data. Todyl says the attacker authenticated as the app, so protections such as multi-factor authentication did not apply. Per BleepingComputer, Huntress saw service principals for ConnectWise's Cloud Management apps assign themselves directory roles, mostly Exchange Administrator, in nearly 50 tenants it monitors. Huntress also saw a Cloud Management app assign itself Global Administrator in at least one tenant and add credentials to an MSP management application and to Huntress's own application. Microsoft saw attempts to add credentials as a backdoor.
ConnectWise says it has no indicators that Cloud Backup partner backup data was compromised and that archives are encrypted and isolated. As of 18 October, per BleepingComputer, Cloud Backup, SaaS Security and Cloud Management were offline, scheduled backups were not running, seven ConnectWise application identities had been disabled and the shared Cloud Backup credentials were no longer valid, though previously issued access tokens may remain usable until they expire. | — | — | High | Post-incident |
| Select a row for narrative, affected systems, remediation, and sources. | |||||
CVSS and EPSS values were retrieved on 19 October 2026. EPSS is recalculated daily and CVSS scores can be revised by NVD or the vendor, so check the linked score before acting on it.
Threat Actor Profiling
T1 and T2 are incidents with no named actor. The T3 zero-day exploitation is attributed to Armory Castle, which Mandiant and Google Threat Intelligence Group track as a suspected China-nexus espionage actor, and Volexity tracks the T4 actor as UTA0576, with low confidence that the motive is criminal. T10 carries the tracking names CL-STA-0954 and UNC5820 for a 2024 intrusion; they are not shown to be behind current exploitation. T5 to T9 and T11 name no actor. MITRE technique codes are hover-to-define abbreviations. A row with no sourced technique says so in prose instead of borrowing a code.
| Threats | Actor | Sectors | MITRE tradecraft | Kill chain |
|---|---|---|---|---|
| T1 | Unattributed. The company names no actor and no method | Retail, Loyalty programs | No ATT&CK technique is named in the notice or the reporting. | Not established in sourced reporting. The company says it found unauthorized activity on one server on 13 October and shut the server down. |
| T2 | Unattributed. The district's notice names no group or ransomware family | Education, Public sector | No ATT&CK technique is named in the notice or the reporting. | Not established in sourced reporting. The notice says an unauthorized party gained access to its systems and, during a ransomware attack, copied and stole files containing personal information. |
| T3 | Armory Castle (formerly UNC5221), which BleepingComputer reports Mandiant and Google Threat Intelligence Group track as a suspected China-nexus espionage actor. BeyondTrust's timeline, as reported by The Hacker News, names the same actor | Cross-sector, Remote access | Abuse insufficient origin validation in internal messaging components of a self-hosted appliance (CCCS, BeyondTrust) → unauthorized file operations and a PHP web shell called SAWFLY → root access through a set-user-ID copy of the system shell, giving access to every credential the appliance stored or brokered, a SOCKS5 tunneling tool called BARECLAW, attempts to harvest credentials from the appliance's secrets database, remote sessions opened to downstream systems from the Jump Item list, and deletion of logs (Mandiant, via The Hacker News and BleepingComputer). | |
| T4 | Volexity tracks the actor as UTA0576 and assesses with low confidence that the motive is criminal, not espionage | Cross-sector, Network infrastructure | Chain CVE-2026-104935, an authentication bypass and a remote code execution flaw, with a third flaw, a privilege escalation → run commands as root, re-running the exploit for every command with no malware or web shell, altering logs and evading the Integrity Checker Tool → take stored credentials including LDAP domain credentials, search Active Directory for passwords and run password-spraying attacks → exfiltrate limited Active Directory metadata, deploy a Kerberos tool capable of Kerberoast attacks, capture LDAP packets and search for administrator passwords and BitLocker recovery keys (Volexity, via The Hacker News). | |
| T5 | Unattributed. The Hacker News reports it is unclear how the flaw is exploited, by whom or against whom | Cross-sector, Endpoints | Microsoft's described attack scenario, not observed activity: send a specially crafted file by email or instant message → convince the user to take an action, such as clicking a link to the attacker's site → Mark of the Web defenses are evaded (Microsoft). Who is exploiting it, and how, is not established (The Hacker News). | |
| T6 | Unattributed. Huntress observed the attackers; the reporting names no group | Cross-sector, Backup and recovery | Exploit the AhsayCBS API authentication flaw (CVE-2026-105133) and then the Replication Receiver command injection (CVE-2026-105134) (component names per NVD) → unauthenticated remote code execution → deploy web shells and XMRig cryptocurrency miners (Huntress, via The Hacker News and BleepingComputer). | |
| T7 | Unattributed. Cisco's advisory does not say who attacked or how many devices | Cross-sector, Email security | Send an email with a crafted attachment through a gateway with File Reputation enabled and assigned to a mail policy and Content Scanner Tools earlier than 25.3.0.5525 → relative path traversal in Advanced Malware Protection → arbitrary file write and commands as root (Cisco, via The Hacker News and BleepingComputer). Cisco warns that an attacker with root may remove evidence. | |
| T8 | Unattributed. Palo Alto Networks reports very limited exploitation and names no actor | Cross-sector, Network infrastructure | Reach the management interface with a high-privilege login → code injection in the management interface → arbitrary code with root privileges on the firewall (Palo Alto Networks, CISA KEV). How the attacker obtains the login is not stated. | |
| T9 | Unattributed. CISA's 15 October KEV alert cites evidence of active exploitation; Atlassian says it found no evidence of exploitation on its Cloud products and names no actor | Cross-sector, Collaboration and development tools | Send an unauthenticated request that names the exact file and path → read specific files in the web application root, with no directory listing (Atlassian). Later steps are not established. | |
| T10 | Palo Alto Networks Unit 42 tracks the telecommunications intrusion as CL-STA-0954 (also known as UNC5820), per The Hacker News. Who is exploiting the flaw now is not stated | Telecommunications, Network infrastructure | FortiManager flaw CVE-2024-47575 gave initial access in the 2024 intrusion → an archive of running configurations, cryptographic material and databases for more than 500 managed FortiGate firewalls was taken → the attackers set up unauthorized SSL/VPN sessions and stopped syslog generation → CVE-2025-61624 was used to deploy PEERSTITCH, memory-resident malware injected into the miglogd and iked processes that bypasses checks on tagged VPN sessions → the attackers deleted their own rogue administrator accounts and auto-script objects after use (Unit 42, via The Hacker News). | |
| T11 | Unattributed. Microsoft says a threat actor compromised the trusted OAuth app; the sources used name no group | Managed service providers, Cloud and SaaS | Sign-in attempts from the attacker's IP address on 13 and 14 October, password spraying against four law firm tenants with no successful user sign-ins detected → obtain the ConnectWise Cloud Backup application credential (how is not stated) → authenticate as the app's service principal into consented Microsoft 365 tenants, with broad successful sign-ins from one IP address on 15 October → service principals for ConnectWise's Cloud Management apps assigned themselves directory roles, mostly Exchange Administrator, in nearly 50 tenants Huntress monitors; in at least one tenant a Cloud Management app assigned itself Global Administrator, and credentials were added to an MSP management application and to Huntress's own application (Huntress and Microsoft, via The Hacker News and BleepingComputer). |
▶Table methodology & sourcing notes
- T1 and T2 have no sourced ATT&CK technique. T2's notice confirms a ransomware attack and data theft but does not describe encryption, the entry method or the exfiltration path, and Pattison describes no method for T1, so no code is assigned. Other codes are our classification of the steps the cited reporting describes, not techniques a vendor or agency named. T10 uses T1685 Disable or Modify Tools, which replaced the revoked T1562.006 Indicator Blocking in ATT&CK.
- The Armory Castle tracking name on T3 is Mandiant's and Google Threat Intelligence Group's, per BleepingComputer; BeyondTrust's timeline, as reported by The Hacker News, names the same actor. UTA0576 on T4 is Volexity's. The CL-STA-0954 (also known as UNC5820) name on T10 describes the September 2024 intrusion that Unit 42 analyzed. Sector labels are our classification of the affected products, not sector targeting named by a source.
- Kill-chain steps come only from the cited reporting. Where a source stops, the chain stops.
- T1, T2 and T11 have no CVE and no score. T9 has no NVD score because its CVE record is rejected; Atlassian rates it CVSS 4.0 9.3. T6 scores CVE-2026-105134 (CVSS 4.0 9.3); CVE-2026-105133 is 5.5. T8 uses Palo Alto Networks' CVSS 4.0 8.6; NVD's own 3.1 score is 7.2. T10 uses Fortinet's CVSS 3.1 6.0 as listed in NVD; NVD's own 3.1 score is 6.5, and the 5.4 The Hacker News reports is Fortinet's temporal score. T8 and T10 need an authenticated attacker, and their vendors rate them High and Medium; both are CRITICAL here because CISA lists them as exploited, the brief's rule for KEV-listed flaws.
Control Deficiency & Framework Mapping
| Threat | Control gaps | ISO 27001 | NIST CSF 2.0 | CIS Controls | Privacy Act / PIPEDA | ITSG-33 | OSFI B-13 | ISO 42001 |
|---|---|---|---|---|---|---|---|---|
T1More Rewards Loyalty Database Accessed (Pattison Food Group, Save-On-Foods) |
| — | — | |||||
T2Burnaby School District: Ransomware Confirmed, Files With Personal Information Stolen |
| — | — | |||||
T3BeyondTrust Remote Support Authentication Bypass (CVE-2026-102764), CCCS AL26-025 |
| — | — | |||||
T4Ivanti Connect Secure Authentication Bypass Zero-Day Chain (CVE-2026-104935) |
| — | — | |||||
T5Windows Shell Security Feature Bypass Zero-Day (CVE-2026-96951) |
| — | — | |||||
T6AhsayCBS Authentication Bypass and Command Injection Chain (CVE-2026-105133, CVE-2026-105134) |
| — | — | |||||
T7Cisco Secure Email Gateway Arbitrary File Write and Root Command Execution (CVE-2026-76519) |
| — | — | |||||
T8Palo Alto Networks PAN-OS Authenticated Remote Code Execution in the Management Interface (CVE-2026-0322) |
| — | — | |||||
T9Atlassian Data Center Arbitrary File Access, CISA KEV (CVE-2026-21589, Record Rejected) |
| — | — | |||||
T10Fortinet FortiOS Path Traversal Used to Deploy PEERSTITCH (CVE-2025-61624) |
| — | — | |||||
T11ConnectWise Cloud Backup Application Credential Abused in Microsoft 365 Tenants |
| — | — |
Privacy Act / PIPEDA & OSFI: The Privacy Act / PIPEDA column is blank on every row. T1 and T2 are confirmed incidents involving personal information, but neither organization is federally regulated and no source establishes federal jurisdiction: the district is a B.C. public body and reported to the Office of the Information and Privacy Commissioner for B.C., and Pattison Food Group says it notified the appropriate authorities and privacy regulators without naming them. T3 to T10 are CVE rows and do not by themselves establish a breach. T11 reports no confirmed data theft. ISO 42001 is not mapped on any row this week. Federally regulated institutions should map T3 to T10 against B-13 patch and access evidence on remote support, VPN, Windows endpoint, firewall, email gateway, collaboration and backup systems, as the OSFI column does, and T11 against third-party risk.
Risk Triage
Threats are assigned to primary zones based on their dominant organizational risk characteristic. A threat may appear in a secondary zone when it presents a materially distinct compounding risk dimension.
Exposure Velocity
Active exploitation or weaponized capability with immediate organizational exposure if unaddressed.
- T3BeyondTrust CVE-2026-102764, KEV due 19 October
CVSS 4.0 9.3. First known zero-day exploitation on 29 August; CCCS Alert AL26-025. Treat exposed appliances as potentially compromised.
- T4Ivanti Connect Secure CVE-2026-104935, KEV due 16 October, passed
CVSS 3.1 8.6, EPSS 25.98%. Worked on a fully patched appliance and evaded the Integrity Checker Tool; as of 13 October the fix for the third flaw was still to come.
- T5Windows Shell CVE-2026-96951, KEV due 16 October, passed
CVSS 3.1 8.8. Evades Mark of the Web. The one flaw under active attack in a record 1,413-fix release.
- T6AhsayCBS CVE-2026-105134, KEV due 17 October, passed
CVSS 4.0 9.3. The August patches were incomplete. Web shells and miners deployed.
- T7Cisco Secure Email Gateway CVE-2026-76519, KEV due 17 October, passed
CVSS 3.1 9.8. An email with a crafted attachment can give root where File Reputation is on. No fixed build for 16.0, and 16.0.4-302 is not fixed.
- T8PAN-OS CVE-2026-0322, KEV due 17 October, passed
CVSS 4.0 8.6. Root on the firewall through the management interface for an attacker with a high-privilege login. Palo Alto reports very limited exploitation.
- T9Atlassian Data Center, KEV due 18 October, passed, CVE record rejected
File read without a login, limited to known paths in the web application root, across the listed Data Center products, Crucible and Fisheye. No NVD score, because the record was rejected on 16 October; Atlassian rates it CVSS 4.0 9.3, and the vendor advisory and KEV entry remain.
- T10Fortinet CVE-2025-61624, KEV due 19 October
CVSS 3.1 6.0, rated Medium by Fortinet and CRITICAL here because it is in KEV. Needs admin rights, but was used to deploy memory-resident PEERSTITCH malware.
Incident Pressure
Confirmed campaign or large-scale exposure with direct impact on organizations or their data.
- T1More Rewards, confirmed 16 October
Name and, if provided, address, phone number, email and date of birth were accessed. The program has more than 3.5 million members; the number affected is not stated.
- T2Burnaby School District, notice updated 14 October
Ransomware confirmed and files with personal information stolen; the notice says they may have included residency documents and, in some cases, diagnoses. The number affected is not stated.
- T11ConnectWise Cloud Backup, offline since 17 October
A compromised vendor credential was used to sign in to at least 173 Microsoft 365 tenants that Huntress observed. Multi-factor authentication did not apply. Scheduled backups were not running as of 18 October.
Governance & Control Gaps
Structural control deficiencies revealed by the week's threats, independent of any single exploit.
- T4T7T10A clean check is not proof of a clean device
The Integrity Checker Tool was evaded, Cisco warns an attacker with root may remove evidence, and the FortiOS malware leaves no persistent binary on disk. Keep evidence outside the device.
- T6T7A fix recorded is not always a fix
Ahsay's August patches were incomplete, and a Cisco 16.0 gateway on 16.0.4-302, September's fix for CVE-2026-76461, is not fixed for CVE-2026-76519. Track vendor updates to earlier advisories, not only new CVE numbers.
- T9This rejected CVE is still listed as exploited
Tracking that keys only on the CVE number can drop this one, because the record was rejected a day after CISA listed it. Key on vendor advisories and the KEV catalog as well.
- T1T2No count and no entry method yet
Neither organization has said how many people are affected or how the party got in. Say what is known, label the rest provisional, and update.
Strategic Posture
Cross-cutting pattern requiring board-level awareness and program-level response.
- T3T4T7T8T10The entry point is a security product
A remote support appliance, a VPN gateway, an email gateway and two firewall products were all exploited. Each needs a dated inventory entry, an owner and an exposure check.
- T3T6T10T11Tools that hold the keys to other systems
Remote support, backup management, a central firewall manager and a Microsoft 365 backup app each hold access to, or copies of, many other systems' data. Compromise there can expose what they reach.
- T1T2T3Three Canadian-marked rows
Pattison Food Group (More Rewards) and Burnaby School District are confirmed Canadian victims. CCCS Alert AL26-025 covers BeyondTrust Remote Support.
Remediation Actions
Consolidated actions for all eleven threats, organized by time horizon. T-badges indicate which threat each action addresses. T1, T2 and T11 have no patch to apply, so their actions are protective steps, vendor controls and review. CISA's KEV deadlines for US federal agencies have already passed for seven of the nine flaws: two on 16 October, four on 17 October (both AhsayCBS flaws, Cisco and PAN-OS) and one on 18 October. The other two fall today, 19 October.
0 – 24 hours
Immediate response
- T3Apply the BeyondTrust BT26-05-RS patch to self-hosted Remote Support on 24.3.1 through 26.2.3 and the patch for self-hosted Privileged Remote Access, and treat any appliance that was internet-reachable on a vulnerable version during the exploitation window as potentially compromised. The US federal due date is today, 19 October.
- T4Upgrade Ivanti Connect Secure to the fixed version; the CVE record lists 22.8R2.5, 25.1.3.0 and 25.1.3.1 as unaffected, but these do not yet fix the privilege escalation flaw. A clean Integrity Checker result is not proof of a clean appliance. The US federal due date was 16 October.
- T5Install the October Windows updates, starting with the Windows Shell fix for CVE-2026-96951. The US federal due date was 16 October.
- T6Apply the AhsayCBS 10.3.4.45 hotfix on v10 or 9.15.2.70 on v7, v8 or v9 and reboot, even where the August versions are installed. The US federal due date was 17 October.
- T7Update Content Scanner Tools to 25.3.0.5525 or later on every Secure Email Gateway, including gateways already on 16.0.4-302, and confirm it with contentscannerstatus. The US federal due date was 17 October.
- T8Upgrade PAN-OS to the fixed release for your train and restrict the management interface to trusted internal addresses. The US federal due date was 17 October.
- T9Upgrade Atlassian Data Center products, Crucible and Fisheye to the fixed versions in Atlassian's advisory; where you cannot, take them off the internet or apply Atlassian's web application firewall or rewrite rule. The US federal due date was 18 October.
- T10Upgrade FortiOS, FortiProxy, FortiPAM and FortiSwitchManager to the fixed versions in FG-IR-26-122, migrating off FortiOS 7.2, 7.0 and 6.4, which have no fix in their branch. The US federal due date is today, 19 October.
- T11Review Entra service principal sign-ins for application ID 506e08f9-6e9a-4da4-942b-a099a03644ae, disable the implicated ConnectWise applications, and audit credentials added to any application since 13 October. Disabling an app stops new tokens, but issued tokens can stay valid for up to 90 minutes.
- T1Members: treat unexpected calls, emails or texts that use your name, address or date of birth as suspect.
- T2Families: register students with the TransUnion Fraud Alert Database the district offered on 14 October. Staff: use the TransUnion services the district offered after its 1 October notice.
7 days
Short-term hardening
- T3T4T7T8T10Run a compromise check on each remote access, VPN, firewall and email gateway appliance that was exposed on a vulnerable version, using the vendor, CISA and researcher steps in each row. Preserve forensic data before upgrading a suspect virtual appliance.
- T3On any BeyondTrust appliance that is confirmed or suspected compromised, rotate every credential it stored or injected, revoke all active support sessions and review new multifactor authentication registrations on privileged accounts, per CISA.
- T4Where compromise is found, reset all passwords including domain accounts and reissue stored certificates. Track Ivanti's release for the third flaw.
- T6Look for JSP web shells, an XMRig miner disguised as edge.exe and a MicrosoftEdgeUpdateSvc service on AhsayCBS servers, and restore the host from a safe backup if a compromise is confirmed.
- T9Search Atlassian access logs, URL-decoded up to two passes, for ".." immediately next to a slash, backslash or double colon.
- T10Review logs held outside the Fortinet devices, since syslog was stopped in the intrusion Unit 42 describes.
- T11Plan for no scheduled Microsoft 365 backups while Cloud Backup is offline.
- T1T2List which personal fields your customer or student systems collect, which are optional, and who can reach them.
14 – 30 days
Program remediation
- T4T6T7Record, for each internet-facing system, whether the vendor has since said a fix was incomplete or the flaw is exploited, and who is told.
- T9Key vulnerability tracking to vendor advisories and the KEV catalog as well as CVE numbers.
- T5Patch by exploitation evidence first when a release carries a record number of fixes.
- T11List every third-party application consented in Microsoft 365 with mail, file or directory permissions, with an approver and a named contact for vendor compromise.
- T1T2Set a retention basis for each type of personal record, and delete what no longer has one.
Ongoing
Structural controls
- T3T4T6T7T8T10Keep a dated inventory of remote access, VPN, firewall and email gateway appliances and backup servers, with an owner and an internet exposure check for each.
- T3T4T5T6T7T8T9T10Reconcile the CISA KEV catalog directly against your patch tracker each week.
- T3T4T6T8T10Record a compromise check beside each patch record for a flaw already exploited when the fix shipped.
- T3T10Treat remote support tools and central firewall managers as among the most sensitive systems, with their own access limits and external log retention.
- T1T2Keep a register of the personal data each customer and student system holds, with a retention basis and an owner for each.
- T11Keep a register of third-party applications with access to your tenant, with an approver and an owner for each.
Provenance
Intelligence Sources
CBC News ↗Global News ↗Pattison Food Group ↗Burnaby School District ↗CBC News ↗Canadian Centre for Cyber Security ↗BeyondTrust ↗The Hacker News ↗BleepingComputer ↗CISA ↗CISA ↗NVD ↗BleepingComputer ↗The Hacker News ↗The Hacker News ↗CISA ↗NVD ↗The Hacker News ↗CyberScoop ↗Microsoft ↗CISA ↗CISA ↗CISA ↗NVD ↗The Hacker News ↗Ahsay ↗BleepingComputer ↗CISA ↗NVD ↗NVD ↗BleepingComputer ↗The Hacker News ↗CISA ↗NVD ↗Palo Alto Networks ↗The Hacker News ↗CISA ↗NVD ↗Atlassian ↗CISA ↗CISA ↗CVE Program ↗NVD ↗The Hacker News ↗Fortinet ↗CISA ↗NVD ↗NVD ↗The Hacker News ↗BleepingComputer ↗
Cadence
Published weekly. Each issue distills the week's most material threats from primary security reporting and vendor advisories, cross-referenced against authoritative sources (CVE/NVD, CISA KEV, and MITRE ATT&CK) and mapped to the compliance obligations that govern your response. Use Subscribe or Share on any issue to join the distribution list.
See how this week's threats map to your control gaps.
Book a briefing →