Cybersecurity News Briefing: October 18, 2026
Sunday, October 18, 2026 · 4 stories
Today’s briefing highlights a surge in supply‑chain compromises and critical software flaws. Drupal released patches for two remote‑code‑execution vulnerabilities affecting all supported versions, urging immediate installation. A compromised ConnectWise Cloud Backup service enabled access to Microsoft 365 tenants, prompting review of access logs and credential resets. Researchers identified a malicious npm package, and attackers altered AOMEI Backupper update servers to deliver a backdoor. Prioritize applying the Drupal updates without delay.
Top Stories
- CriticalVulnerabilityGlobalBleepingComputer
Drupal releases patches for two critical remote code execution flaws
Drupal has issued patches for two critical vulnerabilities that could allow remote code execution on any supported version of the content management system. The vendor warned that exploit attempts may appear soon. Sites running Drupal are advised to apply the updates promptly.
Why it matters: Unpatched Drupal sites risk remote takeover, so immediate patching is essential.
- HighData BreachGlobalBleepingComputer
Hackers breach Microsoft 365 tenants via compromised ConnectWise Cloud Backup service
ConnectWise shut down customer access to its Cloud Backup service after attackers accessed application identities and compromised Microsoft 365 tenant environments. The intrusion leveraged the supply-chain relationship between ConnectWise and its managed-service-provider customers. Affected organizations should review access logs and reset compromised credentials.
Why it matters: Compromised supply-chain credentials can expose multiple tenant environments, requiring immediate credential rotation.
- HighMalwareGlobalThe Hacker News
MALFEX npm package 'imgdecode' hides Windows shellcode loader
Security researchers discovered a malicious npm package named "imgdecode" that contains a Windows native addon used to load shellcode. The package was uploaded on September 30, 2026, has been downloaded nearly a thousand times and remains available in the registry, forming part of a broader supply-chain attack campaign.
Why it matters: Malicious npm modules can introduce native payloads, so developers should verify package provenance.
- HighMalwareGlobalThe Hacker News
Attackers tampered with AOMEI Backupper update servers to deliver backdoor
Threat actors repeatedly altered files on AOMEI Backupper's official update servers for short intervals between May and July, causing any Windows backup client checking for updates during those windows to download and execute a backdoor. The campaign was observed by multiple threat-intelligence groups.
Why it matters: Compromised update infrastructure can silently install malware, emphasizing the need for signed and verified updates.