ConnectWise customers hit by supply-chain attack linked to compromised API secret

CyberScoopOctober 20, 2026AppSec Cloud

MentionsConnectWise Microsoft Microsoft 365

Hundreds of customers are confirmed impacted, as attackers use a sensitive credential to break into connected Microsoft 365 applications unimpeded. The post ConnectWise customers hit by supply-chain attack linked to compromised API secret appeared first on CyberScoop .

Summary from CyberScoop.

Read the full article at CyberScoop

Explained

The technology and terms in this story. Learn more

AttackSupply-chain attackCompromising a vendor, library or update so the attack reaches all of its customers at once.

Other sources covering the same vulnerabilities or event.

ConnectWise Shuts Off Cloud Services After ‘Unauthorized Access’ to Microsoft 365 Tenants

Infosecurity Magazine6d agoCloud

ConnectWise Cloud Backup application abused in cross-tenant token sweep

Sophos News7d agoEndpointCloud

ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants

The Hacker News7d agoCloud

More in AppSec

SANS Stormcast Monday, October 26th, 2026: PHP2Shell Exploit Reliability; Node.js Brotli Decoder RCE (CVE-2026-111497); Tailscale "Tailworm" Vulnerabilities; HPE ArubaOS 8/10 Patches 72 Flaws

Podcast8 minSANS Internet Storm Center StormCast3h agoAppSecVulnerabilitiesCVE-2026-111497

Risky Bulletin: Brotli RCE is wrecking what's left of the internet

Podcast8 minRisky Business News5h agoAppSec

OpenSSL 4.1.0: What’s new, what’s removed, and what’s still broken

Help Net Security7h agoAppSecNetwork

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

The Hacker NewsyesterdayAppSecVulnerabilitiesCVE-2026-111497

New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack

Socket Blog2d agoAppSec