IT security 2026-10-18

Level Tense — 74/100 — 2026-10-18

Tense day: 4 stories ranked, 2 of the top 4 reported as actively exploited, 0 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: ConnectWise disables Cloud Backup application identities after attackers use them to compromise Microsoft 365 tenants (86/100).

1. ConnectWise disables Cloud Backup application identities after attackers use them to compromise Microsoft 365 tenants — 86/100
2. Drupal patches two critical remote code execution vulnerabilities affecting all supported versions — 70/100
3. Attackers exploit OS command injection flaw in SiteGuard Server Edition to run commands as root or SYSTEM — 70/100
4. Malicious npm package 'imgdecode' in MALFEX campaign hides shellcode loader in Windows native addon — 40/100