TL;DR for CISOs: ConnectWise says attackers abused Cloud Backup application identities, and Huntress reports successful sign-ins in more than 300 Microsoft 365 tenants. Disabling the apps does not undo changes already made. Check Entra for seven ConnectWise app registrations and review role, secret and Conditional Access changes from October 1 to 17.
- Third-party apps with directory permissions are a tenant-level risk. Review which vendor applications can assign roles and add credentials in your Microsoft 365 and Entra environment, and treat them like privileged accounts.
- Four months of undetected access to a state education vendor's file transfer site began with one compromised login. Stale service credentials and file transfer endpoints are still where large data sets leave.
- Attackers are using commercial AI agents to probe and breach web properties at roughly $50 per successful intrusion in one documented campaign. Your public-facing admin panels and third-party vendor sites set the exposure.
Today's slate at a glance
| Story | Severity | Who is exposed | First action |
|---|---|---|---|
| ConnectWise Cloud Backup identities abused in Microsoft 365 | Critical | Any tenant with a ConnectWise Cloud Backup or Cloud Management app registration, including MSP-managed tenants | Search Entra for the seven app registrations and review October 1 to 17 changes |
| California student records via compromised SFTP login | High | Public agencies and vendors holding data on minors or health and disability status | Inventory file-transfer accounts for MFA, owner and download alerting |
| Cairn AI agents breach 100+ company sites | High | Brands with e-commerce, product support or vendor-run sites in the U.S. and Canada | List every public site and admin panel, close exposed panels |
| PEERSTITCH via FortiManager, 500+ firewalls | High | Organizations running FortiManager or FortiGate, directly or through an MSP | Patch, isolate management plane, rotate credentials held by it |
| CISA KEV additions, October 20 | Varies | Plex, Siemens Software Center and SiteGuard users | Confirm exposure and due dates in the catalog |
Lead story: ConnectWise Cloud Backup identities used to sign in to Microsoft 365 tenants
CRITICAL · SAAS / MSP SUPPLY CHAINA vendor app that you or your MSP approved can assign roles and add credentials inside our Microsoft 365 tenant, and switching it off does not undo what it already changed. We are reviewing tenant configuration changes from October 1 to 17 and will report what we find.
Key facts
| Item | Detail | Status |
|---|---|---|
| ConnectWise statement | Identified unauthorized access to application identities in the Cloud Backup environment on October 14. Disabled Cloud Backup on October 17, then SaaS Security and Cloud Management. No indication backup data was compromised | Vendor statement |
| Sign-in activity | Huntress: password spraying against four law firm tenants on October 13 and 14. Sign-in activity from the attacker's address across nearly 1,000 Entra tenants, more than 300 successful as of October 17, up from 162 tenants cited earlier | Reported by Huntress |
| Privilege use | Apps were given directory roles in some tenants, in two cases Global Administrator, and extra credentials were added for persistence. Microsoft says actors likely abused permissions customers had already granted, including highly elevated directory permissions | Reported |
| Second wave | A mostly unsuccessful wave targeted policy, national security, trade and critical mineral organizations. Attacks failed where the ConnectWise app was not present, per The Record | Reported |
| Downstream impact | ConnectWise has not identified confirmed downstream customer compromise and cannot see inside tenants. Todyl would presume compromise wherever the apps are enabled and says the actor worked through partner tenants in tenant ID order | Disputed |
| Unknown | How the identities were first compromised, attacker identity, number of affected customers, whether partner tenant lists were exposed, restoration date | Not confirmed |
What happened
ConnectWise Cloud Backup, formerly SkyKick, protects Microsoft 365 and Google Workspace data and needs broad access to mailboxes, OneDrive, SharePoint and Teams. That access is why a stolen application identity matters: it can read directory data and, where permissions allow, change it.
CoreView notes that ConnectWise's own advisory says disabling the apps does not reverse changes already made inside a tenant. Seven ConnectWise application registrations were disabled on October 17, and older tenants may show them as SkyKick Cloud Manager.
Exposure check
You are in scope if any Entra tenant you own or manage contains one of the seven ConnectWise Cloud Backup or Cloud Management app registrations, including dormant ones and any labeled SkyKick Cloud Manager. Tenants that never had the app blocked the attacker's sign-ins in Huntress's data, so the app inventory is the fastest way to size your exposure.
If your MSP manages your tenants, ask them directly. The Record reports MSPs face higher risk because one tenant can be used to reach others.
Do you treat this as an access incident or a configuration-change incident? Until your logs show no unexplained role, secret or policy changes, treat it as the second.
Evidence
Verified against independently fetched sources:
1. The Record, ConnectWise suspends Cloud Backup service after supply chain attack
2. Dark Reading, ConnectWise disables cloud backups amid concerns for downstream MSPs
3. CoreView Intelligence Labs, disabling the apps does not undo tenant changes
4. The Hacker News, ConnectWise resets credentials as Cloud Backup remains offline
What this means for your team
Your risk is not defined by whether you buy from ConnectWise. It is defined by whether your MSP, your backup vendor or an old migration project left a service principal in your tenant with directory write access. Many security teams cannot answer that from memory.
The harder lesson is about evidence. If the attacker added a role assignment or a client secret before the app was disabled, the app being off does not remove it. Check that your logs go back far enough to support a review.
There is also a board-level question: if a vendor outage takes your backup and monitoring offline for days, what is your recovery position for Microsoft 365 configuration, not just data?
Action checklist
- Check every Entra tenant you own or manage for the seven ConnectWise Cloud Backup and Cloud Management app registrations, including dormant ones and any labeled SkyKick Cloud Manager, and review ConnectWise's published indicators.
- List role assignments, new client secrets and certificates, new app registrations and consent grants, and Conditional Access changes made between October 1 and October 17. Roll back anything you cannot tie to an approved change.
- Review mailbox forwarding rules, new authentication methods on existing accounts and unexpected Global Administrator or Exchange Administrator assignments to service principals.
- Ask your MSPs in writing whether they use these apps in your tenants, what they have reviewed, and when they will report. Add a standing quarterly review of all third-party applications holding Directory.ReadWrite.All.
Supporting story: One compromised login exposed California student records for four months
HIGH · PUBLIC SECTOR / EDUCATION / THIRD-PARTY RISKA single compromised login to a vendor's file transfer site let someone copy student records, including disability data, for about four months before detection. We are confirming that no vendor-held file exchange of ours lacks MFA, an owner and download alerting.
Key facts
| Item | Detail | Status |
|---|---|---|
| Access | Per the California Department of Education, an unauthorized party used a compromised login credential on an ETS SFTP site and copied files with California student information. Access ran May 22 to September 18, 2026 | Confirmed by CDE |
| Timeline | ETS detected the activity September 25. CDE notified district leaders October 2 and announced October 16. Student notifications run into early November | Confirmed |
| Data | Names, birth dates, addresses, schools, state and local IDs, demographics, English learner status and, for some records, disability and Section 504 status and accommodations. CDE says Social Security numbers, financial data, passwords and parent or guardian data were not involved | Confirmed by CDE |
| Scale | Students enrolled in the prior three school years plus some former students back to 2006. California reports more than 5.7 million students enrolled in 2025-2026, which is context and not a victim count | No total published |
| Unknown | How the credential was compromised, attacker identity, number affected, whether data has been published. ETS says it has seen no evidence of publication so far | Not confirmed |
What happened
ETS disabled the account, took the SFTP site offline, and is building a replacement with added controls. It also paused some enrollment data processing and testing work. CDE and the State Board of Education are reviewing ETS's compliance with security and contract requirements, and the state is offering two years of identity protection.
The notable gap is time: about four months of access before detection.
Exposure check
You are in scope if you or a vendor hold data about minors, health or disability status, or public agency data in an SFTP or file exchange, especially where one credential can read large volumes of files.
Disclosure and defensibility: a state agency is reviewing its contractor's compliance with security and contract requirements. If you serve public agencies, expect the same question about your own controls and breach-reporting terms.
Evidence
Verified against independently fetched sources:
1. SecurityWeek, one compromised login exposed millions of California students' records
2. California Department of Education, ETS data incident notification
3. Cybernews, millions of California students' data exposed
What this means for your team
The data here is about minors, includes disability status and is held by a contractor for a public agency. That combination draws regulators, legislators and class actions, and it is the profile of many vendors your own organization uses.
Four months is a detection problem, not only a credential problem. A single login that copies large files from a file transfer site for months should trip volume or geography alerting, and often nobody owns that alert because the system belongs to a vendor or a business unit.
Action checklist
- Inventory every SFTP and file exchange endpoint you or your vendors operate with your data, and confirm each account has MFA or key-based access, an owner and an expiry date.
- Alert on large or unusual downloads and on first-time source locations for file transfer accounts, and test that the alert fires.
- Ask data-holding vendors for their credential rotation policy and mean time to detect, and ask whether they hold data about minors or health and disability status.
- If you serve public agencies or school districts, review your breach notification clauses and what your contracts require you to report and when.
Supporting story: AI agents breached more than 100 company websites, including Deere, SharkNinja and Cummins
HIGH · AI-DRIVEN ATTACKS / E-COMMERCEAutomated AI agents breached more than 100 company sites at roughly $50 per success in one documented campaign, mostly through side sites and control panels nobody was watching. We are inventorying every public-facing property, including vendor-run sites.
Key facts
| Item | Detail | Status |
|---|---|---|
| Campaign | Researcher Snorre Fagerland of NorForge found exposed Cairn control panels. Reuters reports websites of more than 100 companies were breached in a couple of weeks and more than 1,200 sites were attempted, starting September 25, targeting e-commerce in the U.S., Canada, Australia and Japan | Reported by Reuters and NorForge |
| Cost and speed | About $5,000 in token costs, roughly $50 per successful intrusion, about 23 hours per success. Reuters reports a mix of DeepSeek and Anthropic's Claude Code was used | Researcher estimate |
| Named victims | Deere said it took remediation actions and saw no sign sensitive information was accessed. SharkNinja said a standalone product support site was affected and contained. Cummins said it was investigating a possible attack on a site run by a third-party vendor | Company statements to Reuters |
| Technique | Agents that failed against a main application found related infrastructure, a public-facing control panel and a data-processing flaw to run commands. NorForge reports about 10 percent attack success and that 11 percent of secrets seen in exposed data were verified valid | Reported |
| Unknown | How much data, if any, was taken. The Cairn author told Reuters the platform was not designed for hacking | Not confirmed |
What happened
NorForge identified three clusters using exposed Cairn panels: the largest Chinese-language operation seeking persistent web shell access on large e-commerce platforms, a second focused on payment card and cryptocurrency theft, and a third targeting large commercial platforms for shell and database access. Gambit Security separately reported an agent-driven campaign that breached 25 companies in September.
The attackers left control panels open, which is what exposed the campaign.
Exposure check
You are in scope if you run e-commerce, product support, microsites or regional sites, or use vendors who host them for you, particularly in the U.S. and Canada. Check for internet-reachable admin panels and for secrets stored in those environments.
Two of the three named victims reported the affected asset was a side site or a vendor-run site, not the main application.
Evidence
Verified against independently fetched sources:
1. SecurityWeek, AI platform Cairn abused to hack over 100 organizations
2. Reuters via BNN Bloomberg, how one hacker used AI agents and a few thousand dollars to break into scores of sites
What this means for your team
The named victims are recognizable North American manufacturers, and in two of three cases the exposed asset was not the main application. Expect automated agents to be patient with the long tail of properties nobody on the security team inspects.
At $50 per success, volume is no longer a constraint for attackers. Your controls need to hold up against thousands of low-cost attempts, not a few expert ones.
Action checklist
- Build a list of every public-facing site, control panel and vendor-hosted property tied to your brand, including product support, microsites and regional sites, and assign an owner to each.
- Close administrative panels to the internet or place them behind identity-aware access, and review them first.
- Rotate secrets stored in application environments on exposed sites and check that valid keys cannot be found in code or configuration.
- Include side sites and vendor-run properties in external attack surface scanning and web application firewall rules, and tell your board that automated, low-cost attacks are the new baseline.
Supporting story: PEERSTITCH shows how one FortiManager can expose 500 firewalls
HIGH · NETWORK EDGE / MSPOne compromised firewall management server exposed configurations and credentials for more than 500 firewalls at a telecom MSP. We are confirming how our providers isolate their management planes and rotating anything a management platform holds if it was exposed.
Key facts
| Item | Detail | Status |
|---|---|---|
| Intrusion | Unit 42 found the activity during an intrusion at a telecommunications managed service provider that began in September 2024. Attackers used FortiJump (CVE-2024-47575) on a FortiManager appliance and exfiltrated configurations, cryptographic material and databases covering more than 500 managed FortiGate firewalls. Tracked as CL-STA-0954, also known as UNC5820 | Reported by Unit 42 |
| Implant | PEERSTITCH is memory-resident and patches two FortiOS daemons so tagged VPN sessions skip default security validation. No persistent binary on disk | Reported by Unit 42 |
| Privilege escalation flaw | CVE-2025-61624, a FortiOS path traversal rated CVSS 5.4, patched April 2026. The Hacker News reports a CISA KEV listing on October 16 with a federal deadline of October 19. SC Media dates the addition to October 19 | Dates differ by source |
| Scope | Unit 42 scoped its work to the provider. Client exposure is stolen configuration and credential material, not confirmed intrusion into client networks | Confirmed limit |
| Unknown | Full victim list and whether the 500-plus firewalls were later accessed | Not confirmed |
What happened
Stolen material included device serial numbers with public IP addresses, network topology, routing tables, encrypted administrative and VPN credentials and certificates with private keys. The actors used it for reconnaissance, persistence, traffic interception and unauthorized VPN sessions, according to The Hacker News.
Unit 42 gives detection steps, including inspecting process memory for anonymous executable regions in the two affected daemons and searching configuration revisions for auto-script objects with directory traversal strings.
Exposure check
You are in scope if you run FortiManager or FortiGate, or if an MSP or telecom manages your network devices. The management platform is the asset to check first, because its stored credentials and certificates stay valid until rotated.
Federal agencies were given until October 19 to patch CVE-2025-61624, which tells you where exploitation sits in the priority order.
Evidence
Verified against independently fetched sources:
1. The Hacker News, attackers exploit FortiOS flaw to plant PEERSTITCH
2. Unit 42, PEERSTITCH and the FortiManager compromise
What this means for your team
Management platforms hold the keys to everything they manage. Compromise of one appliance exposed configurations and credentials for hundreds of devices.
If your provider is an MSP or telecom, their management plane is part of your attack surface, and your contract should say who can reach it.
Action checklist
- Inventory FortiManager and FortiGate versions across your estate and your MSPs' estates, patch CVE-2025-61624 and the FortiJump flaw, and confirm the management interface is not reachable from the internet.
- Assume credentials and certificates held by a compromised management platform are exposed. Rotate administrative, VPN and certificate material, and revoke old certificates.
- Run the Unit 42 hunt steps and check for unexpected auto-script objects, syslog gaps and rogue administrator accounts.
- Ask each network MSP how its management plane is isolated and who can reach it.
CISA KEV watch
| CVE or product | Weakness | Added | Due date and notes |
|---|---|---|---|
| Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 (one chain) | SSRF and path handling chain | October 20 | October 23 for two entries, November 3 for two. Plex confirmed wide exploitation on October 19. One entry flagged for forensic triage under BOD 26-04. Fixed in 1.43.3.10861 |
| Siemens Software Center: CVE-2026-110936 | DLL sideloading | October 20 | Exploitation confirmed by Siemens, used in ClickFix attacks per SecurityWeek. Fixed in 4.0.9.8 |
| SiteGuard Server Edition: CVE-2026-106931 | OS command injection to root or SYSTEM | October 20 | Version 2.20 and later with statistics enabled. Save diagnostic information before patching |
| Fortinet: CVE-2025-61624 | FortiOS path traversal | October 16 or 19, sources differ | Federal deadline October 19. Covered above |
The CISA alert page and catalog could not be retrieved for this edition. The October 20 entries come from two agreeing secondary sources: WindowsForum summary of the CISA alert and HOL, Plex2Shell on CISA KEV. Confirm due dates and the ransomware-use flag in the catalog before briefing your board. Plex is mostly a consumer product but appears on corporate networks and home offices, so check unmanaged devices that touch your network.
Also notable
- Paradigm Healthcare Services: The San Francisco company that handles Medi-Cal billing data reported more than 970,000 affected people to HHS. Detection was October 13, 2025 and notification letters are dated September 14, 2026, about 11 months later. Data included names, birth dates, gender and Medi-Cal member IDs. Source: SecurityWeek (single source reviewed).
- Ahold Delhize: The grocer confirmed malicious actors were behind an outage that took systems offline at most of its U.S. and European brands. The Record reports U.S. online shopping at Food Lion and Stop & Shop was still not working. The company says it has no evidence sensitive data was stolen and has not disclosed the attack type. Sources: The Record and SecurityWeek.
- Drupal and PHP: Drupal published fixes for critical RCE flaws in its Entity List module and core Field UI module and warned exploits could appear within hours or days, with no exploitation known yet. PHP scheduled emergency patches for two critical RCE flaws for October 21 at 14:00 UTC, with no fix for 8.1 and older. Sources: SecurityWeek on Drupal and BleepingComputer on PHP.
- eMudhra certificate authority keys: Mozilla confirmed private keys for eight eMudhra intermediate certificates were compromised and blocked them in Firefox within three hours of the report. Go, NSS-based software and bundled CA lists need updates. Sources: Mozilla Security Blog and The Hacker News.
- Palo Alto GlobalProtect: Unit 42 reports Qilin and INC ransomware operators attempting to exploit CVE-2026-0257, patched in May, then reaching virtualization and backup layers in at least one case. Sources: Unit 42 and The Hacker News.
Frequently asked questions
Is my Microsoft 365 tenant affected by the ConnectWise Cloud Backup incident?
Check whether any of your Entra tenants contains one of the seven ConnectWise Cloud Backup or Cloud Management app registrations, including ones labeled SkyKick Cloud Manager. Huntress reports successful sign-ins from the attacker's address in more than 300 tenants as of October 17, and tenants without the app blocked the sign-ins.
Does disabling the ConnectWise apps remove the attacker's changes?
No. ConnectWise's advisory, as quoted by CoreView, says disabling the apps does not reverse changes already made inside a tenant. Review role assignments, client secrets, app registrations and Conditional Access changes from October 1 to October 17.
What should a CISO review in Entra after the ConnectWise incident?
Directory roles assigned to the ConnectWise apps, new client secrets or certificates on other service principals, new app registrations and consent grants, mailbox forwarding rules, new authentication methods and Conditional Access exclusions.
Who is affected by the California student records breach?
Current and former California public school students, including students enrolled in the prior three school years and some who left as far back as 2006. A compromised credential was used to copy files from an ETS SFTP site between May 22 and September 18, 2026. The total affected has not been published.
Can AI agents breach company websites at scale?
One documented campaign says yes. Reuters reports an operator used the open-source Cairn agent engine to breach more than 100 company websites at roughly $50 per success, with Deere, SharkNinja and Cummins describing contained or ongoing reviews.
What is PEERSTITCH and should I worry about FortiManager?
PEERSTITCH is a memory-resident implant Unit 42 found on FortiGate firewalls at a telecom MSP after attackers compromised a FortiManager appliance. That compromise exposed configurations and credentials for more than 500 managed firewalls, so patch, isolate the management plane and rotate stored credentials.
What was added to the CISA KEV catalog on October 20, 2026?
Six entries: four Plex Media Server CVEs from one chain, a Siemens Software Center DLL sideloading flaw and a SiteGuard Server Edition command injection flaw, according to two secondary sources. Confirm in the catalog.
What should a CISO do first this week?
Review third-party applications with directory permissions in your Microsoft 365 tenants, inventory file transfer endpoints and public web properties, and confirm how your MSPs isolate their management platforms.
Curated by Pritha Aash, Community Head, CISO Platform
Last updated: October 21, 2026
Subscribe to the weekly newsletter
More from the Breach Intelligence hub, including the BeyondTrust Remote Support zero-day and the Ivanti Connect Secure zero-day chain, plus vulnerability management coverage on CISO Platform.
Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.
Comments