{
  "schema_version": 3,
  "report_contract_version": 5,
  "report_plan": {
    "control_implications": [
      {
        "control_id": "third_party_risk",
        "evidence_excerpt": "The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a",
        "evidence_origin": "summary",
        "focus": "BeyondTrust Remote Support",
        "priority": "high",
        "source_ids": [
          2
        ]
      },
      {
        "control_id": "access_management",
        "evidence_excerpt": "Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs",
        "evidence_origin": "summary",
        "focus": "ConnectWise Cloud Backup",
        "priority": "high",
        "source_ids": [
          12
        ]
      },
      {
        "control_id": "vulnerability_management",
        "evidence_excerpt": "Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers…",
        "evidence_origin": "summary",
        "focus": "Magento and Adobe Commerce",
        "priority": "high",
        "source_ids": [
          1
        ]
      },
      {
        "control_id": "data_protection",
        "evidence_excerpt": "An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without",
        "evidence_origin": "summary",
        "focus": "OpenCode Console",
        "priority": "high",
        "source_ids": [
          6
        ]
      },
      {
        "control_id": "change_management",
        "evidence_excerpt": "Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems…",
        "evidence_origin": "summary",
        "focus": "Windows Server security updates",
        "priority": "medium",
        "source_ids": [
          4
        ]
      },
      {
        "control_id": "vulnerability_management",
        "evidence_excerpt": "Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named \"imgdecode,\" was uploaded to the package registry on September 30, 2026, by a user named \"malfexteste8.\" It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of",
        "evidence_origin": "summary",
        "focus": "malicious npm package",
        "priority": "high",
        "source_ids": [
          11
        ]
      }
    ],
    "executive_brief": {
      "decision_frame": "separate",
      "source_ids": [
        2,
        12,
        1
      ]
    },
    "industry_impacts": [],
    "regulatory_changes": []
  },
  "generated_at": "2026-10-21T13:08:27.166345Z",
  "feed_url": "https://ricomanifesto.github.io/SentryDigest/feed.xml",
  "feed_home_url": "https://ricomanifesto.github.io/SentryDigest/",
  "digest_issue_date": "2026-10-19",
  "digest_issue_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-19/",
  "requested_model": "openrouter/nvidia/nemotron-3-ultra-550b-a55b:free",
  "resolved_model": "nvidia/nemotron-3-ultra-550b-a55b:free",
  "sources": [
    {
      "title": "Critical BlockStrap flaw lets hackers run code on Magento servers",
      "url": "https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-19/#reporting-eef67d66b352",
      "cves": [
        "CVE-2026-103849"
      ],
      "snippet": "Critical BlockStrap flaw lets hackers run code on Magento servers Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers… Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers…",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers…",
          "text": "Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers…",
          "text": "Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers",
      "url": "https://thehackernews.com/2026/10/china-linked-hackers-exploited.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-19/#reporting-2f4ebff472d5",
      "cves": [
        "CVE-2026-102764"
      ],
      "snippet": "China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a… The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 20",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a…",
          "text": "The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a…",
          "text": "The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic",
      "url": "https://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-19/#reporting-62badca6addc",
      "cves": [],
      "snippet": "Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. \"The tools delivered information-stealing malware and backdoors for macOS and Windows machines,\" Elastic… A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. \"The tools delivered information-stealing malware and backdoors for macOS and Windows machines,\" Elastic…",
          "text": "A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. \"The tools delivered information-stealing malware and backdoors for macOS and Windows machines,\" Elastic…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. \"The tools delivered information-stealing malware and backdoors for macOS and Windows machines,\" Elastic…",
          "text": "A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. \"The tools delivered information-stealing malware and backdoors for macOS and Windows machines,\" Elastic…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Microsoft: October Windows Server updates break Exchange sign-in, mail flow",
      "url": "https://www.bleepingcomputer.com/news/microsoft/microsoft-october-windows-server-updates-cause-exchange-issues/",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-19/#reporting-d0d6e449ab45",
      "cves": [],
      "snippet": "Microsoft: October Windows Server updates break Exchange sign-in, mail flow Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems… Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems…",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems…",
          "text": "Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems…",
          "text": "Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers",
      "url": "https://thehackernews.com/2026/10/unpatched-broadcom-wi-fi-flaw-lets.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-19/#reporting-13914d489178",
      "cves": [],
      "snippet": "Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device… A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device…",
          "text": "A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device…",
          "text": "A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys",
      "url": "https://thehackernews.com/2026/10/opencode-console-breach-may-have.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-19/#reporting-6dda7c5d535a",
      "cves": [],
      "snippet": "OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without… An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted ",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without…",
          "text": "An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without…",
          "text": "An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Hackers exploit SiteGuard WAF flaw to run commands as admins",
      "url": "https://www.bleepingcomputer.com/news/security/hackers-exploit-siteguard-waf-flaw-to-run-commands-as-system-root/",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-19/#reporting-de332aa1deff",
      "cves": [],
      "snippet": "Hackers exploit SiteGuard WAF flaw to run commands as admins Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers… Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers…",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers…",
          "text": "Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers…",
          "text": "Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants",
      "url": "https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-19/#reporting-1a74dd4c9004",
      "cves": [],
      "snippet": "ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise… ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and ",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise…",
          "text": "ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise…",
          "text": "ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack",
      "url": "https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-19/#reporting-622bd9511527",
      "cves": [],
      "snippet": "Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants… ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants…",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants…",
          "text": "ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants…",
          "text": "ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Drupal patches critical RCE flaws, warns exploits may emerge soon",
      "url": "https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-19/#reporting-978985bee2a5",
      "cves": [],
      "snippet": "Drupal patches critical RCE flaws, warns exploits may emerge soon Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system… Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system…",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system…",
          "text": "Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system…",
          "text": "Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon",
      "url": "https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-19/#reporting-219fd9eab491",
      "cves": [],
      "snippet": "MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named \"imgdecode,\" was uploaded to the package registry on September 30, 2026, by a user named \"malfexteste8.\" It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of… Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named \"imgdecode,\" was uploaded to the package registry on S",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named \"imgdecode,\" was uploaded to the package registry on September 30, 2026, by a user named \"malfexteste8.\" It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of…",
          "text": "Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named \"imgdecode,\" was uploaded to the package registry on September 30, 2026, by a user named \"malfexteste8.\" It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named \"imgdecode,\" was uploaded to the package registry on September 30, 2026, by a user named \"malfexteste8.\" It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of…",
          "text": "Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named \"imgdecode,\" was uploaded to the package registry on September 30, 2026, by a user named \"malfexteste8.\" It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants",
      "url": "https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-19/#reporting-614eb364146c",
      "cves": [],
      "snippet": "Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs… Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerl",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs…",
          "text": "Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs…",
          "text": "Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs…"
        }
      ],
      "effective_date_evidence": null
    }
  ]
}