The Strondex Blog
Recent security incidents in plain English, what happened, and the specific controls that would have changed the outcome. Written for the people who have to answer for it.
Want the at-a-glance view? See the Cyber Breach Tracker, recent breaches mapped to the exact control that would have stopped each one.
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
Attackers stole an application credential from ConnectWise Cloud Backup (formerly SkyKick) and used it to silently access Microsoft 365 tenants at scale, bypassing MFA entirely. ConnectWise suspended the service on October 17, 2026 after confirming unauthorized access to at least 162 tenants.
October 19, 2026 Read the analysis →China-Linked Hackers Exploited a BeyondTrust Zero-Day for Seven Weeks Before Anyone Knew
A China-nexus threat group tracked as ARMORY CASTLE exploited a critical zero-day in BeyondTrust Remote Support for roughly seven weeks before public disclosure, escalating to root on affected appliances and accessing every credential those systems handled. Here is what happened and what it means for organizations that rely on any remote support tooling.
October 16, 2026 Read the analysis →Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
A maximum-severity flaw in the Bricksforge WordPress plugin (CVE-2026-85097) allows unauthenticated attackers to upload arbitrary PHP files and execute code remotely. Active exploitation was confirmed by Patchstack beginning October 7, 2026, with at least 63 unique attacking IP addresses observed.
October 12, 2026 Read the analysis →Danish University DTU Breach Exposes Data of Up to 200,000 People
Attackers used compromised credentials to access DTUBasen, the Technical University of Denmark's identity and access management system, potentially exposing CPR numbers, home addresses, and next-of-kin details for up to 200,000 current and former users. The incident is a clear illustration of what happens when a single set of stolen credentials reaches a system that holds two decades of sensitive records.
October 5, 2026 Read the analysis →Critical FortiMail Zero-Day (CVE-2026-104286) Exploited in the Wild: What You Need to Know Now
A CVSS 9.8 path traversal flaw in Fortinet FortiMail is being actively exploited before patches are available, allowing unauthenticated attackers to write arbitrary files to the underlying system. CISA added it to the KEV catalog the same day Fortinet published its advisory, with a three-day remediation deadline for federal agencies.
October 2, 2026 Read the analysis →Bitget Resumes Bitcoin Withdrawals After $387.5 Million Crypto Heist
A backend infrastructure compromise at Bitget drained approximately $387.5 million from hot and warm wallets across seven blockchains on September 24, 2026. Attackers exploited a vulnerability in a third-party security product to obtain high-level internal credentials, then issued fraudulent withdrawal commands that bypassed authorization controls.
September 28, 2026 Read the analysis →ShinyHunters Claims FBI Hack and Data Theft in PeopleSoft Zero-Day Breach
ShinyHunters claims it breached FBI systems through an Oracle PeopleSoft zero-day, exfiltrating between 2 TB and 3 TB of data on current and former FBI employees. The group defaced FBIjobs.gov and threatened to deploy the same vulnerability against Fortune 500 organizations.
September 23, 2026 Read the analysis →North Korean WaterPlum Hackers Infected 30,000 Devices Worldwide Through Fake Job Interviews
A North Korean hacking group called WaterPlum ran a fake job interview campaign from December 2025 through July 2026, infecting at least 30,000 devices across more than 100 countries and transferring over $10 million in stolen cryptocurrency to Pyongyang. A joint advisory from the FBI, ACSC, and four other agencies published on September 18, 2026 details the full scope.
September 21, 2026 Read the analysis →Brevo Supply Chain Attack: How a Hardcoded API Key Put 100,000+ Sites at Risk
Attackers stole a long-lived Cloudflare API key hardcoded in Brevo's source code, deployed a malicious Cloudflare Worker, and injected ClickFix social-engineering overlays across Brevo customer sites for roughly five and a half hours on September 14, 2026. Sansec estimates more than 100,000 websites were potentially exposed.
September 18, 2026 Read the analysis →Malicious Admin Menu Editor Pro Plugin Backdoors 1,500 WordPress Sites
A trojanized update to the premium Admin Menu Editor Pro plugin, available for about seven hours on September 14, 2026, planted a web shell and a hidden admin account on an estimated 1,500 WordPress sites. The attack weaponized the vendor's own update channel, giving site owners no obvious warning.
September 16, 2026 Read the analysis →Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data
Since May 2026, threat actors tracked as Storm-3121 and Storm-3032 have been calling employees on personal phones, impersonating IT help desks, and steering them to adversary-in-the-middle login pages to hijack Microsoft 365 cloud accounts. Once inside, the attackers add their own MFA methods, then quietly drain SharePoint, OneDrive, and mailboxes through the Graph API.
September 14, 2026 Read the analysis →AI-Powered Attack Exploited PaperCut Flaws to Hack 395 Organizations
Two zero-day vulnerabilities in PaperCut NG/MF were chained into a pre-authentication RCE exploit and weaponized by hundreds of AI agents, compromising 440 instances across 395 organizations in 48 countries before most admins had finished reading the advisory.
September 11, 2026 Read the analysis →N-able N-central Pre-Auth RCE Flaw (CVE-2026-86218) Exploited in the Wild
A maximum-severity static code injection flaw in N-able N-central is being actively exploited, allowing unauthenticated attackers to execute arbitrary code on RMM servers. CISA added CVE-2026-86218 to its Known Exploited Vulnerabilities catalog on September 8, 2026, and Shadowserver found roughly 1,500 internet-exposed instances.
September 9, 2026 Read the analysis →JetBrains Breached Its Own Cadence Environment by Skipping a Patch It Told Everyone Else to Apply
Attackers exploited a critical unauthenticated RCE flaw in JetBrains TeamCity (CVE-2026-63077, CVSS 9.8) to breach the company's own Cadence cloud-compute environment, exfiltrating a 2024 server backup containing AWS IAM credentials and user data. JetBrains had published the patch weeks earlier but failed to apply it to its own infrastructure.
September 7, 2026 Read the analysis →Critical Elementor Pro Flaw Exploited to Take Over WordPress Sites
A critical arbitrary file upload vulnerability in Elementor Pro (CVE-2026-32475) allowed unauthenticated attackers to upload PHP webshells and execute arbitrary code. Wordfence blocked more than 190,000 exploitation attempts in the five days after the patch dropped.
September 4, 2026 Read the analysis →Critical Langflow Flaw Exploited to Steal OpenAI and AWS Keys
A CVSS 9.8 code injection flaw in Langflow (CVE-2026-0768) allowed unauthenticated attackers to execute arbitrary Python as root, with active exploitation observed harvesting OpenAI API keys and AWS credentials from production deployments. VulnCheck reported more than 15,000 successful attacks.
September 2, 2026 Read the analysis →FulcrumSec Claims Manchester Airports Hack and Theft of 86 GB of Data
Extortion group FulcrumSec claims it stole approximately 86 GB of data from Manchester Airports Group by exploiting API credentials left exposed in client-side JavaScript. Around 8.7 million customers across three UK airports had their data compromised.
August 31, 2026 Read the analysis →Hundreds of Leaked AWS Keys Give Full Control Over Corporate Accounts
Truffle Security re-verified 10,616 leaked AWS key pairs on August 10, 2026, and found 88% still authenticate. Of those, 768 corporate keys carry full administrator access, including 130 root keys on AWS Organizations management accounts.
August 24, 2026 Read the analysis →SickKids Data Breach Exposes Employee and Job Applicant Info Through Third-Party Software Flaw
A vulnerability in a third-party software application gave unauthorized parties access to personal information belonging to current and former SickKids employees and job applicants. The breach was first identified on July 9, 2026, and the affected system also supported HR functions including payroll.
August 21, 2026 Read the analysis →One Attacker Has Been Scraping Salesforce and ServiceNow Portals Since Early 2025
A single threat actor has been running an automated scraping campaign against Salesforce Experience Cloud and ServiceNow Service Portals since at least March 2025, abusing misconfigured guest-user permissions to exfiltrate data. The campaign, named City-Forum by researchers at Reco, is ongoing and volume is increasing.
August 19, 2026 Read the analysis →SafePal Data Breach Exposes 39,798 Customers Through Third-Party Order Plugin Flaw
A flaw in a third-party order-tracking plugin gave anyone who guessed an order number access to other customers' shipping details, names, and purchase info. Nearly 40,000 SafePal hardware wallet buyers are now at elevated risk of phishing and physical attacks.
August 17, 2026 Read the analysis →Akira Hackers Disable EDR with Safe Mode, Steal Data, but Fail to Encrypt
An Akira ransomware affiliate rebooted a victim host into Safe Mode to blind its EDR tools, then exfiltrated data before a memory crash stopped the encryptor. The data theft succeeded even though the encryption did not.
August 14, 2026 Read the analysis →Attackers Are Scanning for CVE-2026-59310: What VMware vCenter Admins Need to Do Now
A critical directory traversal flaw in VMware vCenter's Syslog Server component allows unauthenticated remote code execution with a CVSS score of 9.8. Threat actors began actively scanning for exposed systems within two weeks of the patch release.
August 12, 2026 Read the analysis →Metabase SQLi Zero-Day Exploited in Customer Data-Theft Attacks
A CVSS 10.0 unauthenticated SQL injection zero-day in Metabase versions 1.58 and above was actively exploited against Metabase Cloud on August 3, 2026, resulting in confirmed breaches at Framework and Tally Forms. Self-hosted operators were left to patch manually while attackers had already walked out with customer records.
August 10, 2026 Read the analysis →Swiss Government SharePoint Breach Compromised Around 200 Accounts
Switzerland's federal IT agency FOITT disclosed a breach of its on-premises SharePoint servers that compromised approximately 200 user and technical accounts. Attackers likely exploited SharePoint vulnerabilities patched just weeks earlier, while CISA had already flagged active exploitation in the wild.
August 7, 2026 Read the analysis →Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
The Greatness phishing-as-a-service toolkit has expanded to include OAuth device code flow abuse, letting operators bypass MFA and steal session tokens from Microsoft 365, Google Workspace, iCloud, and Yahoo accounts. Here is what that technique actually does and what controls can blunt it.
August 5, 2026 Read the analysis →N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete
Attackers exploited CVE-2026-18577, a bypass of N-able's own patch for CVE-2026-18556, to gain administrative control of on-premises N-central servers and then pivot to downstream managed endpoints. The incident shows how an incomplete patch can be more dangerous than no patch at all, because it creates a false sense of remediation.
August 3, 2026 Read the analysis →Microsoft Teams Vishing Campaign STAC4749 Delivers Chaos Ransomware in Under 17 Hours
A vishing campaign tracked as STAC4749 targeted dozens of North American organizations between February and June 2026, using Microsoft Teams calls to impersonate IT helpdesk staff and trick employees into granting remote access. At least three intrusions ended with Chaos ransomware deployed in as little as 17 hours.
July 31, 2026 Read the analysis →Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass (CVE-2026-16232)
A critical authentication bypass in Check Point SmartConsole was actively exploited before patches shipped on July 22, 2026. A public proof-of-concept followed two days later, compressing the patch window for every organization running an exposed Management Server.
July 29, 2026 Read the analysis →OnTrac Data Breach Exposes SSNs and Medical Data for 40,000 Individuals
Lasership Inc., doing business as OnTrac Final Mile, disclosed a network intrusion that exposed sensitive personal and medical information for over 40,000 individuals. The breach is a textbook case of what happens when network access controls fail to contain an intruder once they are inside.
July 27, 2026 Read the analysis →Russian Espionage Group Exploited a Zimbra Zero-Day to Steal Mail and 2FA Codes
A Russian state-supported espionage group tracked as LAUNDRY BEAR exploited a stored XSS zero-day in Zimbra Collaboration Suite to silently steal email, credentials, and 2FA codes. The flaw required no user interaction beyond viewing a message.
July 24, 2026 Read the analysis →Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA
German and US authorities dismantled Kratos, a Phishing-as-a-Service platform that targeted Microsoft 365 accounts across 35 countries using session-cookie theft to bypass MFA. The July 2026 takedown seized more than 200 servers and led to the arrest of the alleged developer in Indonesia.
July 22, 2026 Read the analysis →Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access
Threat actors exploited CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect, to gain unauthorized VPN access and deploy Qilin ransomware across multiple organizations in June 2026. Arctic Wolf Labs traced the full attack chain from perimeter compromise to domain-wide encryption.
July 21, 2026 Read the analysis →Forg365: A New Phishing-as-a-Service Platform Using AI to Compromise Microsoft 365 Accounts
Researchers at ZeroBEC have uncovered Forg365, a phishing-as-a-service platform that combines adversary-in-the-middle and device-code phishing with AI-generated lures to steal Microsoft 365 credentials and session tokens. The platform is purpose-built to bypass standard MFA and maintain persistent access to compromised accounts.
July 10, 2026 Read the analysis →Accenture Confirms Breach After Hacker Offers Stolen Data for Sale
A threat actor operating as '888' claimed to have stolen 35 GB of Accenture data including source code, Azure credentials, and SSH keys, and listed it for sale on a cybercrime forum on July 6, 2026. Accenture confirmed the breach but disclosed little about scope or method.
July 8, 2026 Read the analysis →AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack
A threat operator named JADEPUFFER used an AI agent to carry out what Sysdig researchers describe as the first fully autonomous, end-to-end ransomware operation, exploiting a critical Langflow vulnerability to encrypt production database records without meaningful human involvement. The attack succeeded largely because of foundational hygiene failures that most organizations share.
July 3, 2026 Read the analysis →FBI: Russian Hackers Now Target Signal Backup Recovery Keys
The FBI and CISA warn that Russian Intelligence Services are phishing Signal users for their Backup Recovery Keys — giving attackers persistent access to full message histories even after victims change accounts. Here is what changed, who is at risk, and the one control that matters most.
June 29, 2026 Read the analysis →Polymarket Customers Lose $3 Million in Supply-Chain Attack
On June 25, 2025, a compromised third-party frontend dependency injected malicious JavaScript into Polymarket's website, tricking users into approving fraudulent transactions and draining approximately $3 million in pUSD from more than 11 wallets. Polymarket's own servers and smart contracts were untouched — the entire breach ran through a vendor's code.
June 27, 2026 Read the analysis →CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue
CISA added CVE-2026-12569, a critical (CVSS 9.3) unauthenticated RCE flaw in PTC Windchill and FlexPLM, to its Known Exploited Vulnerabilities catalog after attackers began deploying persistent JSP web shells. Manufacturing and retail supply-chain organizations running unpatched Windchill instances face active risk right now.
June 26, 2026 Read the analysis →Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root
Threat actors are actively exploiting CVE-2026-20230, a CVSS 8.6 SSRF flaw in Cisco Unified CM and Unified CM SME that lets unauthenticated remote attackers write arbitrary files and escalate to root. Cisco patched on June 3, 2026; organizations on Release 14.x must upgrade to 14SU6 immediately or disable the WebDialer service as an interim workaround.
June 24, 2026 Read the analysis →LastPass Confirms Data Breach in Klue Supply Chain Attack
A threat actor compromised Klue's integration infrastructure using a legacy credential, stole OAuth tokens, and accessed LastPass customer data inside Salesforce, exposing names, emails, addresses, and support records. At least ten other enterprise organizations were also confirmed victims.
June 23, 2026 Read the analysis →Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT
Three typosquatting npm packages impersonating a PostCSS utility delivered a Windows RAT with Chrome credential theft. The lesson: govern the third-party code flowing into your build pipeline.
June 23, 2026 Read the analysis →“Apple Files Leaked on the Dark Web” Was a Supplier Breach: Tata, World Leaks, and Third-Party Risk
Confidential Apple files hit the dark web, but Apple was never breached. The data came from contract manufacturer Tata Electronics. The lesson: your IP is only as safe as the weakest vendor holding a copy of it.
June 23, 2026 Read the analysis →The Surveillance System Became the Breach: MSG, ShinyHunters, and the Data You Shouldn't Keep
ShinyHunters published Madison Square Garden's facial-recognition logs, secret risk dossiers, and SSNs. The entry point is undisclosed, so the real lesson is data minimization: you can't lose what you didn't keep.
June 21, 2026 Read the analysis →FortiBleed: 75,000 Firewalls, and the One Control That Stops It
A credential-harvesting campaign exposed admin and VPN logins on tens of thousands of Fortinet firewalls across 194 countries. Here's how it worked, and why your cyber insurer asks about MFA on remote access.
June 19, 2026 Read the analysis →The Canvas Breach: When Your Vendor Gets Hacked, You're Still on the Hook
ShinyHunters breached the Canvas learning platform twice in two weeks, hitting thousands of schools. The lesson for every business: your data lives in vendors you don't control, and your insurer knows it.
June 19, 2026 Read the analysis →Charter, a Phone Call, and the ShinyHunters Extortion: The Vishing Playbook
No malware, no zero-day, just a phone call and missing phishing-resistant MFA. How ShinyHunters walked into a telecom giant, and what underwriters now expect you to have in place.
June 19, 2026 Read the analysis →