Cyber, in brief

ConnectWise, a company that sells software to IT firms, has shut off customer access to its Cloud Backup service after attackers got hold of the service's own key. [1]

Cloud Backup, once called SkyKick, copies the email and files of organisations that use Microsoft 365, Microsoft's online office software. To do that, it is allowed to read their mailboxes, files and Teams chats. [2]

Huntress, a security firm, says it saw confirmed break-ins at 173 organisations' Microsoft 365 accounts made with that stolen key. [2]

The sign-ins came from one internet address on 15 October, between 06:13 and 08:34 UTC, a few seconds apart. Huntress says that points to a program working down a list. [2]

The attacker signed in as the backup app, not as a person. So the second check that Microsoft 365 asks of people, a code or a tap on a phone, never came up. [1]

Todyl, another security firm, says the access could read and change mail, files and Teams chats. In the nine accounts it studied, it found only sign-ins, with no new accounts or changed passwords. [1]

Huntress saw ConnectWise's management apps give themselves administrator powers in nearly 50 accounts it watches. [1] In one account, an app made itself the top administrator and added new keys to an IT management tool and to Huntress's own security app. [2]

Microsoft confirmed attacker activity on the service and called it an active supply-chain attack, meaning an attack that comes through a supplier its victims trust. [1]

ConnectWise says it has no sign so far that the backup copies it stores were touched. [1]

Switching the app off stops new access, but keys already issued keep working for up to 90 minutes, Todyl says. [2] Keys the attacker added to other apps stay until someone removes them, Huntress says. [1]

ConnectWise tells IT staff to check the app's sign-in records for unknown addresses. Huntress advises switching the apps off and removing any keys added since 13 October. [1][2]

Why it matters. Watch whether ConnectWise says how its key was taken and confirms it has been replaced, and whether any organisation finds that mail or files were copied. [1][2]

Google's Mandiant and ManageEngine researchers say attackers tampered with the update servers of AOMEI Backupper, a program for backing up computers. [2] For five to ten minutes at a time, the servers sent harmful software instead of the real update, then switched back. [2] This ran from April to July 2026, the researchers say. [2] They link it to a new group they call UNC7017, and found victims in 11 countries, including the US, India, Spain and South Africa. [2]

Why it matters. IT firms, phone companies and universities that trusted the update were hit. It is the second backup tool reported this week as a way in. [2]

Meta, which owns Facebook and Instagram, is telling about 1,500 people, most of them its own US staff, that their personal data was taken. [3] Outsiders used one employee's stolen login to get into some of Meta's code stores on GitHub, a site where programmers keep their code. [3] Meta says 99% of what they took was code, and 1% was personal data put there by mistake, against its own rules. [3] It has not said what kind of personal data it was. [3]

Why it matters. The people affected are being offered checks on their credit and on criminal websites. [3] Meta says it has changed the secret keys in those stores and added scans to catch personal data uploaded there. [3]

A cyberattack on BAE Systems, a British defence company, has stopped notices from every US federal bankruptcy court. [8] BAE runs the system that sends them, and notices have not gone out since 9 October. [7] A court notice on Tuesday called it a nationwide service interruption, and only on 15 October did the courts call it a cybersecurity incident. [7] The websites were still offline on Friday. [7] BAE says the problem is limited to that one system. [8]

Why it matters. Debtors and the people they owe are not getting their court notices. [9] A court in eastern Texas gave cases filed since 14 September that have a pending request to pause them an extra 30 days. [6]

Canada is weighing a law called C-22 that could make tech companies, including foreign ones, build ways for police to reach users' data. [5] It could also make them keep records of what users do. [5] Signal, a messaging app that scrambles messages, says it would leave Canada if the bill passes. [5] Psiphon, a Canadian tool that helps millions of people in Iran stay online during shutdowns, says the same. [5]

Why it matters. The bill says companies will not have to build in weak spots, but opponents say any built-in way to read scrambled messages is one that others can find. [5] Apple and Meta have criticised it. [5]

Lena Schilling, an Austrian member of the European Parliament, learned last month that faked nude pictures of her were online. [13] They were made from photos of one of her first press conferences, with her clothes removed by AI. [13] A report by Agora Digitale Transformation, a Berlin research group, found 50 members targeted this way, 46 of them women. [13] 119 lawmakers have signed a letter asking the EU to enforce its coming ban on such apps. [13]

Why it matters. The EU ban on apps that undress people in photos is due to start on 2 December. [13] The letter says a ban on paper protects no one until someone enforces it. [13]

Building systems run a site's heating, lights, door locks and cameras, and attackers are now using them for leverage, The Register reports. [11] Armis Labs, a security research team, found 73% of the organisations it studied own building systems of a kind already used in ransomware attacks. [11] Dragos, which guards factories, counted 1,020 ransomware incidents against industrial firms in January to March and 1,140 in April to June, partly from gangs' own claims. [11] In August, a ransomware attack upset door controls at a Canadian hospital. [11]

Why it matters. When doors lock or food spoils, a victim is under more pressure to pay than when only files are stolen. [11] Dragos says fewer than one in ten factory networks is watched closely enough to spot this. [11]

Connected fridges and freezers at a dozen US military food stores on bases defrosted overnight in August, causing large food losses, the Guardian reports. [12] The Guardian sets it beside last Sunday's attack on the fridges of up to 700 French supermarkets. [12] Gerome Billois of Wavestone, a consulting firm, says France has still not put into law the EU's 2024 rules that make internet-connected devices meet security standards. [12] No group has claimed the French attack. [12]

Why it matters. Billois calls the delay on those rules a disaster. [12] He says finding the French attackers could take weeks or months. [12]

A harmful package called imgdecode was found on npm, a huge free library of code that programmers add to their projects. [10] It was uploaded on 30 September, downloaded 979 times, and was still online when SafeDep, a security firm, reported it. [10] It belongs to MALFEX, a campaign posting harmful packages to npm since August 2023. [10] When npm removed two of its packages on 28 September, replacements appeared within two days. [10]

Why it matters. It aims at programmers' Windows computers. [10] The newest version, posted on 11 October, no longer needs any of the packages npm removed. [10]

Attackers are using a flaw in SiteGuard Server Edition, a web firewall from EG Secure Solutions, a Japanese company, The Hacker News reports. [4] A web firewall is software that screens what reaches a website. The flaw affects version 2.20 and later when a statistics setting is on, which it is by default. [4] JPCERT, Japan's computer emergency team, has warned about it. [4] Nobody has said who is behind the attacks. [4]

Why it matters. Sites running SiteGuard Server Edition with its default statistics setting are the ones exposed. [4] It is not known who has been targeted. [4]

The Xen project, which makes software that runs many virtual computers on one machine, fixed a flaw credited to Anthropic's Claude Opus, an AI model. [4] The flaw could let a guest computer take control of the machine underneath, in all Xen versions since 4.0. [4] Samsung fixed a flaw rated 9.8 out of 10 in QA-Board, its research tool. [4] Claude Opus also flagged that one. [4]

Why it matters. Anyone running Xen can install the fix or use a setting that blocks the flaw. [4] Neither report mentions any attack using these flaws. [4]

Gen Digital, a security company, describes Warden Stealer, a new program sold to criminals that steals passwords and data. [4] It is one of the first to target the settings files of AI assistants and AI coding tools, Gen Digital says. [4] It also swaps copied cryptocurrency addresses for the thief's own. [4] Its makers change it often to avoid detection. [4]

Why it matters. Programmers who use AI coding tools keep keys in those files that open company systems and paid AI accounts. [4] Symantec says a similar program, Aoki, is already going after the same files. [4]

Rapid7, a security firm, found a serious flaw in WebAlliance eCommerce, shop software made by Channel Software. [4] It is rated 9.8 out of 10. [4] An outsider could read the shop's database, including customers' personal details and passwords, without logging in. [4] Rapid7 says no fix has been announced. [4]

Why it matters. Shops using WebAlliance, and their customers, have no fix to install yet. [4]

Google has raised what it pays researchers who report some kinds of flaws in Chrome, its web browser. [4] The base reward for memory-safety flaws, bugs in how a program handles memory, went from $500 to $2,000. [4] Flaws in some parts of Chrome can now earn up to $20,000. [4] Google had lowered several rewards in April. [4]

Why it matters. Researchers who find these bugs now get four times the old base reward for reporting them to Google. [4]