Actively exploited flaws hit Drupal, ScreenConnect and GMO cloud

Five Nines reported on Friday that Drupal's security team warned on Wednesday that an access-control bypass in the Commerce Core module is being actively exploited. The advisory, which Drupal rated highly critical, names CVE-2026-118539 and says the issue stems from missing authorization and can be reached by unauthenticated attackers. Versions from 0.0.0 through 2.41 and from 3.0.0 through 3.3.13 are affected. Drupal instructs sites on the 3.x branch to upgrade to Commerce Core 3.3.13 and older installations to move to Commerce Core 8.x-2.41. Administrators should review orders for unusual activity because the flaw is under active exploitation. Drupal credited Dan Puccetti, Marcus Johansson and Robert Snyder for reporting the bug. The module runs on more than 42,000 sites, including Fortune 500 companies and research universities.

BleepingComputer reported that Huntress uncovered an active campaign against managed service providers that abuses compromised ScreenConnect environments to install rogue remote-access clients. Huntress said it found six compromised MSPs, 286 affected endpoints and 47 organizations, with activity beginning around 17:47 UTC. Attackers use ScreenConnect's Run Command function to push clients to managed endpoints, creating remote access outside the legitimate MSP environment. Huntress also described a possible reverse-pivot technique that could compromise a technician's workstation when they connect to an infected customer device; it is not clear whether this exploits a vulnerability or legitimate functions. ConnectWise confirmed to BleepingComputer that it is investigating and advised partners to avoid interactive remote sessions with suspected compromised devices, end sessions, reset credentials from a trusted device, and confirm multifactor authentication. Huntress said telemetry points to stolen credentials and hijacked MSP support sessions, and sequential attacker-assigned tags suggest earlier compromises. Published indicators include relay 185.99.255[.]28, C2 domains newnewnew.gotdns[.]org and soxnewwork.homedns[.]org, and rogue client IDs 2588ef5c15954b10 and ed630cc2c873b091. BleepingComputer also located a July 25 batch script that referenced one of the rogue IDs and impersonated a Social Security Administration statement, though it is unclear whether that file belongs to the current campaign.

Five Nines reported on Sunday that GMO Internet Group asked Japanese officials to invoke the country's active cyber defense law after unauthorized access to as many as 26,739 servers in its Onamae.com Desktop Cloud service. GMO first revealed the breach on October 21 and said malicious programs had been placed in customer server environments; the company took every server offline on Wednesday and warned that customer login information might have been exposed. In an October 25 blog post, Chief Executive Masatoshi Kumagai said the attackers used the access to make unauthorized trades for customers at more than 70 brokerages worldwide, not just to steal data. He wrote that the internet "is already starting to break down" and made a formal request for the government to invoke the law. GMO stated that the likely attacker demanded money and threatened to disclose company information if the demand was not met; the company plans to refuse and has reported the matter to police. Kumagai added that the attackers threatened to publish personal information from customers' PCs, install ransomware, and reveal internal details about GMO's systems. GMO said every affected customer will receive a flat ¥5,000 consolation payment and that it will fully compensate any trading losses caused by the unauthorized access. The law took effect on October 1 and lets police and Self-Defense Forces reach attackers' servers to remove malware or disable attack-command functions, but officials have said a company request by itself does not trigger government action. Experts questioned whether the mechanism fits: Taiyo Tsuchiya, a professor at Keio University, said the request falls outside the neutralizing measures the active cyber defense system was designed for, while Jun Osawa of the Sasakawa Peace Foundation called the threshold extremely high because it could be viewed as an act of war by another country.

Defenders should verify Commerce Core versions and audit orders for unauthorized changes; ScreenConnect users should review Run Command history and the published indicators.