US Cybersecurity Briefing – Monday, Oct 19, 2026 (includes weekend)

Nothing new to report.

Attackers used the vendor's own app credential (a client assertion held in ConnectWise's tenant) to sign in to customer Entra tenants as the Cloud Backup app and obtain Microsoft Graph tokens. MFA did not apply because these were app sign-ins. Huntress confirmed unauthorized sign-ins in 162 tenants as of Oct 16. In about 50 monitored tenants, ConnectWise Cloud Management apps assigned themselves directory roles, mostly Exchange Administrator. In one tenant, the Teams app made itself Global Administrator and added secrets to other apps, including Huntress's own. Attacker IP: 144.172.64[.]128. A password spray from that IP hit four law-firm tenants on Oct 13–14; the firms are not named. No customer victims or threat actor have been publicly named. ConnectWise disabled seven app identities on Oct 17 and took Cloud Backup, SaaS Security and Cloud Management offline. As of Oct 19 it had no restoration time and said it had found no evidence that backup data was compromised.

Action: disable (don't delete) the ConnectWise/SkyKick enterprise apps in Entra, then audit service-principal sign-ins, role assignments and new app credentials since Oct 13.

Huntress →    BleepingComputer →    Infosecurity Magazine →

BAE runs the Bankruptcy Noticing Center (BNC) for the Administrative Office of the US Courts and confirmed a “security incident that is isolated to the BNC system.” Paper and electronic notices issued since Oct 9 have not been delivered, and the National Creditor Registration Service is offline. Courts are still accepting filings. Neither the cause, any ransomware involvement, data exposure nor a threat actor has been disclosed, and there is no restoration date.

SecurityWeek →

The county confirmed that an unauthorized actor accessed a limited number of county systems and copied files. It first detected the activity on Aug 28. The Rhysida ransomware gang claimed the attack, saying it took 2.6 TB, and demanded $2M. The data types and number of people affected have not been disclosed. This is separate from the county's 2025 ransomware incident; breach letters for that one were due to go out Oct 19.

The Record →

The attack was identified Saturday, Oct 17, and took district communications and network operations offline. Monday classes, Jerome Middle School conferences and most athletic practices were canceled. The district is investigating with state and federal agencies. No attacker has been named, and the district has not said whether ransomware was involved or student/staff data was accessed.

DysruptionHub →

No other confirmed, named US victim incidents surfaced in the weekend window.

An unauthenticated file upload leads to host takeover; versions through 26.2.3 are affected. Mandiant/GTIG attribute zero-day exploitation since late August to ARMORY CASTLE (formerly UNC5221, suspected PRC espionage), using the SAWFLY webshell and BARECLAW tunneler. No victims are publicly named. Disclosed Oct 15, just before the window.

Action: apply BT26-05, treat any internet-exposed appliance as potentially compromised, and rotate credentials after patching.

Google Threat Intelligence →    The Record →

A privileged, authenticated attacker can write or delete arbitrary files (CVSS 6.0). Fortinet now marks it as known exploited; the advisory was originally published Apr 14, 2026. Fixes: FortiOS 7.6.5+ / 7.4.10+; older branches must migrate. No exploitation details or victims are public.

Fortinet PSIRT →    CISA KEV feed →

I could not open vendor details for this run.

CISA KEV feed →

There is no confirmed exploitation yet, but Drupal warned that exploits may appear within hours or days, and at least one path needs no authentication. Fixes: core 10.6.19 / 11.3.19 / 11.4.10, Entity List 3.0.10, or uninstall field_ui as an interim step. (Second CVE: CVE-2026-108099.)

BleepingComputer →

Gives root/SYSTEM via the default-on statistics feature. US exposure is unclear and victims are unnamed. Save diagnostic information before patching, because patching may erase attack traces.

BleepingComputer →

1. Huntress – ConnectWise vendor credential abuse
2. BleepingComputer – ConnectWise M365 supply-chain attack
3. Infosecurity Magazine – ConnectWise shuts off cloud services
4. SecurityWeek – BAE Systems / bankruptcy courts
5. The Record – Anne Arundel County
6. DysruptionHub – Jerome School District
7. Google Threat Intelligence – ARMORY CASTLE / BeyondTrust
8. The Record – BeyondTrust zero-day
9. Fortinet PSIRT – FG-IR-26-122
10. CISA – KEV catalog feed
11. BleepingComputer – Drupal RCE
12. BleepingComputer – SiteGuard WAF