ConnectWise Breach, SafePay Advisory, and New KEV Flaws Lead Oct 21 Briefing

Security leaders should focus today on ConnectWise's suspension of its Cloud Backup service after attackers abused a compromised Microsoft 365 application credential across more than 160 customer tenants, and on CISA's dual release of a six-vulnerability KEV catalog update and a joint SafePay ransomware advisory covering at least 600 victims. Also in scope: a confirmed 8.2 million-record iRhythm health data breach, a stealthy AOMEI Backupper supply-chain backdoor, a new Pentagon CIO technical advisor, and an urgent PHP security release due later today.

CISA Adds Six Actively Exploited Vulnerabilities to KEV Catalog

CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation, including four Plex Media Server flaws, an EG Secure Solutions SiteGuard Server Edition OS command injection bug, and a Siemens Software Center uncontrolled search path flaw. Federal civilian agencies must prioritize remediation under Binding Operational Directive 26-04, which requires rapid patching of high-risk vulnerabilities on internet-exposed assets. CISA urges all organizations, not just federal agencies, to adopt the same risk-based approach and patch promptly to reduce exposure to these actively exploited bugs. (CISA)

CISA, FBI Issue Joint Advisory on SafePay Ransomware's 600+ Victims

CISA, the FBI, the Secret Service and international partners released a joint #StopRansomware advisory on SafePay, warning the group has impacted at least 600 victims across critical infrastructure sectors in North America, South America, Europe, and Australia since August 2024. SafePay actors gain initial access through credential theft, brute-force attacks, and exploitation of edge-device vulnerabilities including CVE-2023-27532 and CVE-2024-40711, then use living-off-the-land tools like PsExec and WinRM before encrypting files. The advisory urges patching edge devices, enforcing MFA, and restricting administrative tools to limit SafePay's impact. (CISA)

ConnectWise Suspends Cloud Backup After Attackers Abuse Microsoft 365 Access

ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services after a compromised credential let unknown attackers sign in as the backup application across customer Microsoft 365 tenants. Huntress confirmed unauthorized access to at least 162 tenants, with sign-ins traced to a hosting-provider IP address on October 15; it also found nearly 1,000 accounts with sign-in attempts and more than 300 successful ones. ConnectWise disabled seven application identities on October 17 and revoked certificates, but warned that tokens issued before the shutdown may remain usable and that it cannot review customer environments itself. (Help Net Security)

Stealthy Supply Chain Attack Hijacked AOMEI Backupper Update Servers

Security researchers found that attackers repeatedly altered configuration files on AOMEI Backupper's own update servers for five to ten minutes at a time between April and July 2026, directing the software's update mechanism to deliver a backdoor called SHINYROAD instead of legitimate content. Three tampering windows were confirmed on May 28, July 16, and July 20. Confirmed victims span IT services, telecommunications, and higher education organizations in eleven countries including the United States, Australia, and Spain. AOMEI said on July 29 that it had taken corrective action, though how attackers reached its servers remains undisclosed. (Help Net Security)

iRhythm Confirms June Breach Affected 8.2 Million Individuals

Cardiac device maker iRhythm Technologies has confirmed that a June 2026 hacking incident affected 8,179,772 individuals, according to a filing noted on the Oregon Attorney General's data breach list. The compromised data includes patient names, addresses, phone numbers, email addresses, account numbers, device serial numbers, insurance numbers, and dates of birth. iRhythm first disclosed the incident in a Form 8-K after a threat actor claimed to have exfiltrated data and demanded payment; the company says it has found no evidence of data misuse and does not expect a material financial impact. (HIPAA Journal)

Pentagon CIO Adds Strategic Technical Advisor Amid IT Modernization Push

Jon Steinbach has been named strategic technical advisor to Pentagon Chief Information Officer Kirsten Davies, the Defense Department announced, as Davies continues building out her leadership team while pursuing IT modernization, procurement reform, and the direction of the Cybersecurity Maturity Model Certification program. Steinbach previously served with the CIA, Special Operations Command, and the Marine Corps, and later held senior private-sector roles advising technology companies and investors. The appointment follows several other recent additions to the CIO's office, including a new deputy chief of staff and principal deputy CIO named earlier this year. (DefenseScoop)

Critical PHP Security Release Set for October 21 Fixes Two 9.2 Flaws

The PHP security team announced an urgent release for October 21, 2026 at 14:00 UTC, fixing two vulnerabilities each rated 9.2 (Critical) under CVSS v4.0. Details of the flaws and affected versions were withheld until release, meaning administrators should assume every PHP installation could be impacted. The team said it may ship the fix earlier than planned if details leak or exploitation is detected in the wild. Organizations are urged to inventory every PHP instance, confirm who controls updates, and plan maintenance windows shortly after the release. (Help Net Security)