DAILY BRIEFING
ConnectWise Credential Breach, Malicious npm Package, and OpenBSD Root Exploit
Today's briefing covers compromised vendor credentials impacting Microsoft 365 tenants, a malicious npm package targeting Windows, and an OpenBSD privilege escalation exploit.
5 stories2 min read
Supply chain risks and legacy component vulnerabilities dominate today's security developments. Organizations relying on third-party integrations and open-source packages face heightened exposure from compromised vendor credentials and embedded malicious loaders. MSPs and system administrators must prioritize credential audits and software supply chain verification.
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Threat actors compromised a Microsoft 365 credential belonging to ConnectWise Cloud Backup, using it to gain unauthorized access to at least 173 partner and customer M365 environments.
- Why it matters
- Organizations with the app installed face unauthorized attacker access across broad M365 assets, including mailboxes, OneDrive, SharePoint, and directory data.
Critical BlockStrap flaw lets hackers run code on Magento servers
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers.
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
A malicious npm package named imgdecode, part of the MALFEX campaign, contains a Node.js addon that loads a Windows DLL. When executed, the DLL fetches encrypted shellcode from GitHub, decrypts it, and injects the payload into a new dllhost.exe process.
Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
Researchers published a local privilege escalation exploit for OpenBSD 7.9 that chains a 37-year-old integer overflow in shmat with a kernel reference-counting use-after-free flaw, bypassing KARL, SMAP, and SMEP defenses.
- Why it matters
- Local users on unpatched OpenBSD systems can leverage the public proof-of-concept to gain full root execution rights.
Targeted ads installed Candiru spyware in zero-click attacks
Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device.
Key takeaways
- Attackers used a compromised ConnectWise Cloud Backup credential to access 173 Microsoft 365 customer tenants.
- The npm package 'imgdecode' version 1.0.3 drops a malicious Windows DLL that injects shellcode into dllhost.exe.
- OpenBSD released errata 018 and 026 to patch kernel vulnerabilities used in a local root privilege escalation chain.