Weekly Brief
exploited flaws and supply-chain incidents
Hackers exploit SiteGuard WAF flaw to run commands as admins
Attackers are exploiting an OS command injection flaw in SiteGuard Server Edition to run commands as root or SYSTEM on affected servers. This matters because remote command execution on a WAF can turn a protective control into a full server compromise.
Prioritise patching or isolating SiteGuard Server Edition instances and review them for unexpected command execution or new administrative accounts.
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal has patched two critical vulnerabilities that could allow remote code execution on websites running supported versions of the CMS. It matters because critical CMS flaws are a common route to site defacement, data theft and follow-on compromise.
Update supported Drupal installations immediately and verify which sites expose Drupal to the internet.
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
BeyondTrust Remote Support was hit by a zero-day in the same week other edge products came under attack, continuing a pattern of exposed perimeter software being targeted. The issue matters because compromise of remote support tools can give attackers direct administrative reach into internal networks.
Treat remote support platforms as high priority assets, patch them quickly and monitor for unusual administrative access or session activity.
Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
A China-linked espionage group is reported to be abusing a BeyondTrust zero-day to target remote support servers. The significance is that an active state-linked campaign against support infrastructure can create broad access into multiple organisations.
Identify any BeyondTrust Remote Support deployments, apply vendor guidance, and hunt for signs of unauthorised access on management servers.
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust warned customers to patch a critical Remote Support flaw that has been exploited in zero-day attacks since late August. This matters because the exploitation window appears to have been open for weeks before broad disclosure, increasing exposure for unpatched systems.
Escalate patching for BeyondTrust Remote Support and review logs for activity dating back to late August.
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
ConnectWise disabled seven application identities after investigating unauthorised access tied to its Cloud Backup service and compromised Microsoft 365 tenants. The incident matters because abuse of trusted cloud identities can give attackers broad access across customer environments.
Review application identities and service principals tied to backup or MSP tooling, and confirm they are limited to the minimum tenant and mailbox access needed.
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
ConnectWise shut down customer access to Cloud Backup after hackers accessed application identities and compromised Microsoft 365 tenants. It matters because a supply-chain compromise in a managed service can expose many downstream organisations at once.
Check whether your Microsoft 365 environment depends on ConnectWise Cloud Backup and validate any third-party identities with tenant access.
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Attackers tampered with AOMEI Backupper’s update servers for short periods so copies checking for updates could download and run a backdoor. It matters because trusted update channels can be used to distribute malware without users taking any suspicious action.
Verify software update integrity for backup tools and inspect endpoints that downloaded AOMEI Backupper updates during the affected period.