One stolen key breached 173 M365 tenants

Hi there, this is your daily ☕️ Cyberpresso.

Stolen credential breached 173 M365 tenants LINK

• Hackers stole a single ConnectWise Cloud Backup credential and used it to sign in to 173 Microsoft 365 partner and customer tenants, abusing a trusted backup app that already held broad permissions across many organizations.
• Microsoft Threat Intelligence confirmed the supply chain attack is active, with the compromised OAuth app pulling Microsoft Graph access tokens on October 15, 2026; because it signed in as an app-only identity, no user passwords or MFA prompts were needed.
• In one tenant the attackers gained Global Administrator rights and planted new client secrets set to expire in 2028, so defenders should disable (not delete) the ConnectWise apps and hunt for rogue secrets added across all app registrations.

Broadcom flaw lets hackers hijack routers LINK

• A Broadcom Wi-Fi flaw dating back to 2010 lets attackers within wireless range run code on vulnerable routers without knowing the network password or any help from the user, researcher Quentin Kaiser revealed at Hexacon in Paris.
• The bug sits in the WPS setup code and has working exploits: Kaiser pulled the Wi-Fi password from an Orange Belgium router's memory and opened a reverse shell on a Proximus gateway, both over Wi-Fi frames alone.
• Broadcom shipped an incomplete fix in 2018, refused to assign a CVE, and told makers to switch software stacks instead; Kaiser estimates over 1.5 million exposed gateways in Belgium alone, with no patch available as of last Thursday.

WAF firewall bug gives hackers full SYSTEM control LINK

• Hackers are exploiting a command-injection flaw in SiteGuard Server Edition, a Japanese web application firewall, to run commands with root or SYSTEM privileges on affected machines, the vendor and Japan's CERT agency warned.
• The bug, tracked as CVE-2026-106931 and rated critical, sits in the statistics feature that is turned on by default; SiteGuard says it protects more than 1.5 million websites.
• The flaw is being abused in the wild, and the vendor offers an update or a patch that replaces the statistics files, but warns the fix may erase attack traces, so admins should save diagnostic data first.

Breach may expose some users' AI keys LINK

• A break-in at OpenCode on the night of October 16 may have exposed the OpenAI, Anthropic, and Google keys that users had saved in OpenCode Console, the company's optional hosted service for calling AI models.
• OpenCode emailed the affected 1.4% of Console users on the morning of October 17, telling them to revoke and replace each provider key, since deleting a key from Console does not cancel it and a Console budget cannot cap its use.
• Some users report charges they never ran, one cited $281 on OpenAI and $168 on Anthropic, and OpenCode, still under attack on October 18, tied the breach to a "large-scale distillation attack" without explaining the link.

Strategies & Tactics

> Reproducing Windows Kernel Exploitation Techniques with LLM Assistance: A security researcher used ChatGPT to reproduce advanced Windows kernel attacks in roughly 24 hours, showing AI can collapse months of expert work.

> Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug: Researchers gained full OpenBSD root control by chaining a 1988-era counter overflow with a kernel flaw, defeating the system's address-randomization and hardware defenses.

> Closing the Binary Blind Spot: Domain-Knowledge Injection for LLM Malware Triage in npm Packages: Injecting precomputed expert threat-analysis notes into the AI prompt cut malware-detection failures on binary-hiding npm packages from 50% to 4% across cheaper models.

> Jev as a judge: How counterfeit policy steers Jev: Attacker-controlled text that redefines a fast classifier's rules can trick it into approving risky actions, making it unsafe as a standalone security gate.

Other news you might like

• How SentinelOne Blocked APT29's CaptiveCrunch Campaign LINK

• Loud, Fast, and Everywhere: Anatomy of a Real AI-Driven Cloud Attack LINK

• CenterPoint Energy Data Breach Impacts 1 Million Texans LINK

• Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic LINK

• Drupal patches critical RCE flaws, warns exploits may emerge soon LINK

• ‘Wow, it’s a real discovery’: Claude cracks a 25-year NSA number mystery LINK

• Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack LINK

• Microsoft: October Windows Server updates break Exchange sign-in, mail flow LINK

Trending tools

Decawork: deploys employee-built AI agents on company accounts and manages them centrally, controlling access, oversight, and retirement like staff. LINK

Axari: an AI security team that integrates with Slack, automating workflows and status reporting so security staff can focus on actual outcomes. LINK

Prized: builds and deploys secure internal tools with AI, offering pre-connected scoped data, full audit trails, and one-click deployment behind company sign-in. LINK

Ghostifier: scans your inbox to find companies tracking you, then automatically unsubscribes and sends data deletion requests without ever reading your emails. LINK

Servor: manage all your servers from one console with a web terminal, file editor, scheduled jobs, monitoring, and alerts, no open ports required. LINK

mcpgawk: monitors MCP servers for tool changes, baselines their behavior in a sandbox, and blocks altered calls until you approve, running entirely on your machine. LINK

Trending papers & reports

Compliance proof trails let a bank or software agent generate a signed, time-stamped record of exactly which evidence, policies, and transaction details backed a decision, so a third party can later verify it held up. LINK

Quantum-safe key service lets ordinary businesses buy quantum-grade encryption keys without owning the specialized hardware, while ensuring the provider itself can never read the final keys even if its systems are fully exposed. LINK

AI agent security offers a blueprint for locking down how autonomous software agents talk to each other, verifying each agent's identity and encrypting messages so attackers cannot impersonate agents, steal data, or inject malicious commands. LINK

AI safety tests reveal that chatbots understand a harmful request's intent yet still answer it when the wording sounds detailed and specific, cutting refusal rates by ~0.18 even after grasping the danger. LINK

Surprise Masking lets companies train models on sensitive data while scrubbing private details, cutting leaked secret values from ~66% to ~2% without hurting the model's coding performance. LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!