Drupal patches two critical RCE flaws, warns exploits may emerge soon

Cyber security

Credential and supply-chain abuse dominated: ConnectWise, OpenCode and a malicious npm package. Drupal's critical RCE patches come with an explicit warning that exploitation is likely soon. Several items arrived with thin summaries, so scope is unclear.

What happened

• ConnectWise suspended Cloud Backup after attackers used seven application identities to compromise Microsoft 365 tenants. BleepingComputer calls it a supply-chain attack and says customer access was shut down. M365 admins should audit enterprise app registrations and consent grants. BleepingComputer ↗

• Drupal patched two critical remote code execution vulnerabilities in all supported versions and warned exploits may emerge soon. The summary gives no CVE ids or version numbers. BleepingComputer ↗

• The npm package 'imgdecode' carries a shellcode loader in a Windows native addon and is tied to the MALFEX campaign. Audit lockfiles and CI caches for it. The Hacker News ↗

• OpenCode disclosed a breach that leaked user credentials, per a post from its official account. No details on how many users or which credentials were affected. Hacker News (front page) ↗

• PwnEscape reportedly describes a guest-to-host KVM escape tracked as CVE-2026-99999. The summary has no details on affected versions, severity or patch status, so verify against the write-up and vendor advisories. Lobsters ↗

• The Register reports that cybercriminals are increasingly targeting physical building systems such as access control and HVAC rather than only stealing data. Building management networks are often poorly segmented from corporate IT. The Register ↗

• The Register describes a Windows command prompt unexpectedly appearing on an OOHPod, apparently tied to a logged-in shell left unattended. It is a low-stakes reminder that public-facing kiosks need locked-down sessions. The Register ↗

Articles the model saw · 8

• ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants4

  ConnectWise disabled seven application identities after attackers used them to compromise Microsoft 365 tenants, and suspended its Cloud Backup service.

  The Hacker News10 h agobreachmicrosoft-365saasincident-response

  Feed excerpt

  ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise

• OpenCode Hacked: User credentials leaked4

  OpenCode has disclosed a breach in which user credentials were leaked, per a post from its official account.

  Hacker News (front page)yesterdaybreachcredentialsai-tools

  Feed excerpt

  Article URL: https://twitter.com/opencode/status/2111516673953935833 Comments URL: https://news.ycombinator.com/item?id=50133401 Points: 438 # Comments: 79

• Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack4

  Hackers accessed application identities via ConnectWise's Cloud Backup service, compromising Microsoft 365 tenants, and ConnectWise shut down customer access.

  BleepingComputeryesterdaysupply-chainmicrosoft-365breachconnectwise

  Feed excerpt

  ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. [...]

• Drupal patches critical RCE flaws, warns exploits may emerge soon4

  Drupal patched two critical remote code execution vulnerabilities affecting all supported versions, and warned that exploits may emerge soon.

  BleepingComputeryesterdaycvedrupalrcepatch

  Feed excerpt

  Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. [...]

• MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon4

  Malicious npm package 'imgdecode' hides a shellcode loader inside a Windows native addon, linked to the MALFEX supply chain campaign.

  The Hacker Newsyesterdaynpmsupply-chainmalwarewindows

  Feed excerpt

  Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of

• PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)3

  PwnEscape reportedly describes a guest-to-host KVM escape tracked as CVE-2026-99999; the summary has no details.

  Lobstersyesterdaycvekvmvirtualization

  Feed excerpt

  Comments

• Cybercrims go beyond stealing data to attack physical building systems3

  Cybercriminals are increasingly attacking physical building systems like access control and HVAC, not just stealing data.

  The Registeryesterdayotphysical-securitythreat-trends

  Feed excerpt

  'Hold my beer, have fun getting into your offices'

• Oh no, what happened to my OOHPod? Windows command prompt puts in a surprise appearance2

  The Register describes an unexpected Windows command prompt appearing, apparently tied to a logged-in shell left unattended.

  The Register10 h agowindowscommand-line

  Feed excerpt

  Pop quiz: somebody left a command shell logged in. What do you do?