THE CYBERSECURITY BRIEFING
Daily reporting. Deeper analysis. Follow the evidence behind the headlines.
HIGHLIGHT OF THE DAY
Cybersecurity · In depth· 5 min read
ConnectWise announced a Cloud Backup shutdown on October 17 after acknowledging unauthorized access to application identities. Huntress confirmed unauthorized sign-ins across at least 162 tenants, while separate credential changes broaden the investigation.
Cybersecurity
AT A GLANCE
CISA says attackers are exploiting an authentication-bypass vulnerability, CVE-2026-102764, in self-hosted BeyondTrust Remote Support versions 26.2.3 and earlier to gain access, establish persistence, escalate privileges and move laterally. It urges affected organizations to apply BeyondTrust’s BT26-05-RS patch, restrict appliance access and investigate for compromise; older installations must upgrade to a supported version before patching. CISA says BeyondTrust-hosted SaaS deployments have already been patched.
Why it matters For affected appliance operators, the risk extends beyond unauthorized support access: CISA reports attackers using the foothold to persist and move into other systems.
What to watch next The immediate unresolved question for affected self-hosted operators is whether compromise has already occurred; CISA calls for network and memory forensics.
US Certs Alerts ↗Rapid7 reports that CVE-2026-97229, an integer overflow in GitLab CI/CD regular-expression handling, can enable arbitrary command execution as the GitLab operating-system user. The researchers developed a proof of concept against GitLab CE 19.4.1; their described route requires a malicious configuration and specially named path in a public project, followed by an unauthenticated CI lint request. GitLab released fixes in versions 19.4.2, 19.3.5 and 19.2.8; its release notes did not report exploitation in the wild at disclosure.
Why it matters Affected GitLab operators face server-side command execution under the git account, rather than merely a failed CI validation. Rapid7 demonstrated that consequence on a specific CE image, not every deployment configuration.
What to watch next It remains unresolved how the privately reported attack avoids the repository-write prerequisite in Rapid7’s route; the unauthenticated trigger alone does not settle that question.
Rapid7 ↗Fortra researcher Cadence Riddle tracked a 12-fold rise in malicious emails mentioning “RFQ” between October 2025 and September 2026; nearly 73% of the cases led to credential-stealing pages, according to the report. The messages pose as routine quote requests and typically send a link to a fake business sign-in page after the recipient replies; some phishing kits also seek MFA approvals, one-time codes or session tokens. The emails came from 664 sender domains, Riddle said.
LESS NOISE. MORE CONTEXT.
What changed Fortra’s observations show RFQ-themed malicious email volume rising twelvefold between October 2025 and September 2026; this measures the lure’s growth, not a twelvefold increase in successful compromises.
Why it matters A compromised sales or procurement mailbox can expose commercial records and give attackers a trusted identity for targeting customers and suppliers, extending the harm beyond the employee who answered the inquiry.
Help Net Security reports that fake Arch User Repository packages imitating the yay and paru helpers used typosquatted names and malicious installation scripts. A scanner flagged the package “yyay” as malicious with 99% confidence; maintainer Andreas Reichel said its script could run downloaded code with root privileges during installation or upgrade. An AUR maintainer said the user was banned and the packages were deleted.
What changed The response moved from a user report to maintainer confirmation and package removal in less than an hour; that establishes repository cleanup, not cleanup of machines that already installed them.
Why it matters For users installing the impersonated helper, the installation script could give downloaded code full system privileges. The report establishes that capability, not that any particular credential stealer or rootkit was deployed.
HelpNet Security ↗CISA and the FBI issued a public service announcement warning that malicious actors may target election officials, candidates and political organizations during the 2026 U.S. midterm elections. The agencies say phishing and text-message campaigns may seek credentials and sensitive information or deliver malware, using convincing messages and audio or video to prompt action. They urge election and campaign personnel, and the public, to review the guidance and remain alert to suspicious communications.
Why it matters Account theft could expose voter-registration or campaign information because targeted personnel hold access to those resources. The warning concerns that access risk, rather than establishing interference with election results.
US Certs Alerts ↗CISA, NIST and the NSA’s Super Intelligence Security Center published ten voluntary practices for organizations training and evaluating highly capable super-intelligence agents, particularly high-risk systems with reduced safeguards. The guidance addresses restricting agent access, monitoring unexpected activity, preserving evidence, stopping undesired behavior and rebuilding from verified baselines. It also emphasizes testing controls and validating containment before resuming agent activities.
Why it matters For agent-evaluation teams, the guidance makes restoration of control a recovery issue: containment should be validated before work resumes, rather than treating interruption of unwanted behavior as sufficient.
US Certs Alerts ↗