erroneo.us
Search all guides⌘K

Digest · Friday

Security digest: October 16, 2026

2 editorial briefs, 2 known exploited (cisa kev) additions and 2 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: ConnectWise Cloud Backup: App Credential Abused in M365. MSPs and organizations that use ConnectWise Cloud Backup (formerly SkyKick), Cloud Management or SaaS Security for Microsoft 365, including tenants that inherited these apps from a previous provider.
  • Patch this week: Pillow 13.0.0: Critical Image-Parsing Memory Bugs Fixed. Any Python service that opens, thumbnails or re-saves untrusted images with Pillow, such as upload handlers, CMS and Django media pipelines, document converters and ML data loaders.
  • Do you run any of these? BeyondTrust Remote Support, Fortinet Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-19.
  • PyPI: 2 critical advisories (lmcache, claude-agent-sdk). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Breach

ConnectWise Cloud Backup: App Credential Abused in M365

If any tenant you run or manage ever consented to a ConnectWise or SkyKick app, disable those apps and audit the tenant today; attackers used the vendor's own credential to sign in as the app, so MFA did not stop them.

Must act: MSPs and organizations that use ConnectWise Cloud Backup (formerly SkyKick), Cloud Management or SaaS Security for Microsoft 365, including tenants that inherited these apps from a previous provider.

Can relax: Microsoft 365 tenants with no ConnectWise or SkyKick enterprise applications, and Google Workspace-only customers, with no evidence of exposure in the reporting so far.

  1. In every tenant, disable (do not delete) the ConnectWise Cloud Backup and ConnectWise/SkyKick Cloud Management enterprise apps by setting 'Enabled for users to sign-in?' to No.
  2. Remove any directory role a ConnectWise or SkyKick service principal holds that you did not grant, especially Global Administrator and Exchange Administrator.
  3. Review client secrets and certificates on every enterprise app and app registration for anything added since Oct 13, 2026 that you did not create, and remove it.

Read the brief →

Patch this week

· Vulnerability · CVE-2026-96639, CVE-2026-112403

Pillow 13.0.0: Critical Image-Parsing Memory Bugs Fixed

If your service opens images that users or the internet supply, move to Pillow 13.0.0 this week; the worst bugs are memory corruption reachable from a crafted file, and reproducers are in the published advisories.

Must act: Any Python service that opens, thumbnails or re-saves untrusted images with Pillow, such as upload handlers, CMS and Django media pipelines, document converters and ML data loaders.

Can relax: Code that only processes trusted, locally generated images, and Pillow builds older than 11.0.0 for the MPO/PSD bug (they still need 13.0.0 for the others).

  1. Find every Pillow install: pip show pillow, or pip list | grep -i pillow, in each image and virtualenv.
  2. Upgrade with pip install --upgrade 'pillow>=13.0.0', then rebuild and redeploy containers.
  3. Services still on Python 3.10 cannot install 13.0.0: plan the Python upgrade, and apply the workarounds meanwhile.

Read the brief →

Known exploited (CISA KEV) 2

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-102764BeyondTrust Remote Support
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability		2026-10-19
CVE-2025-61624Fortinet Multiple Products
Fortinet Multiple Products Path Traversal Vulnerability		2026-10-19

Critical advisories by ecosystem 2

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 2

Check: pip-audit (or: pip show <package>)