---
title: "Security digest: October 16, 2026"
url: https://erroneo.us/security/2026-10-16/
description: "October 16, 2026 vulnerability digest: 2 briefs (ConnectWise Cloud Backup: App Credential Abused…); 2 CISA KEV additions (BeyondTrust, Fortinet); 2 critical…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-10-16
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: October 16, 2026

2 editorial briefs, 2 known exploited (cisa kev) additions and 2 critical advisories.

## Take stock

- Act now: ConnectWise Cloud Backup: App Credential Abused in M365 . MSPs and organizations that use ConnectWise Cloud Backup (formerly SkyKick), Cloud Management or SaaS Security for Microsoft 365, including tenants that inherited these apps from a previous provider.
- Patch this week: Pillow 13.0.0: Critical Image-Parsing Memory Bugs Fixed . Any Python service that opens, thumbnails or re-saves untrusted images with Pillow, such as upload handlers, CMS and Django media pipelines, document converters and ML data loaders.
- Do you run any of these? BeyondTrust Remote Support, Fortinet Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-19.
- PyPI: 2 critical advisories ( lmcache , claude-agent-sdk ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [ConnectWise Cloud Backup: App Credential Abused in M365](https://erroneo.us/security/briefs/connectwise-cloud-backup-skykick-m365-oauth-compromise/index.md): If any tenant you run or manage ever consented to a ConnectWise or SkyKick app, disable those apps and audit the tenant today; attackers used the vendor's own credential to sign in as the app, so MFA did not stop them.
- **Patch this week** [Pillow 13.0.0: Critical Image-Parsing Memory Bugs Fixed](https://erroneo.us/security/briefs/pillow-13-0-0-security-release-image-parsing-rce/index.md): If your service opens images that users or the internet supply, move to Pillow 13.0.0 this week; the worst bugs are memory corruption reachable from a crafted file, and reproducers are in the published advisories.

## Known exploited (CISA KEV)

- [CVE-2026-102764](https://erroneo.us/security/cve/CVE-2026-102764/index.md) BeyondTrust Remote Support: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability (CISA due 2026-10-19)
- [CVE-2025-61624](https://erroneo.us/security/cve/CVE-2025-61624/index.md) Fortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability (CISA due 2026-10-19)

## Critical advisories

- [CVE-2026-105192](https://erroneo.us/security/cve/CVE-2026-105192/index.md) LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport — PyPI lmcache >= 0.3.9, < 0.5.6 → 0.5.6
- [CVE-2026-96620](https://erroneo.us/security/cve/CVE-2026-96620/index.md) Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution — PyPI claude-agent-sdk < 0.2.121 → 0.2.121

---
Source page: https://erroneo.us/security/2026-10-16/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt