If you manage Microsoft 365 tenants and any of them ever connected ConnectWise Cloud Backup, formerly SkyKick, check those tenants this week. An attacker signed in to customer tenants as the backup application itself. Some of ConnectWise's Cloud Management apps then gave themselves admin roles.

ConnectWise's advisory states that "we identified unauthorized access to application credentials associated with Cloud Backup, formerly SkyKick." Huntress confirmed unauthorized sign-ins in at least 162 tenants, BleepingComputer reports, starting October 15 from 144.172.64[.]128. Huntress later counted "almost 1,000 Entra tenants with sign-in activity from the IP address associated with the unauthorized activity, out of which 300 succeeded," per The Hacker News.

MFA did not apply here. The attacker authenticated as the app, using permissions your clients had already granted it. Todyl's analysis, quoted by BleepingComputer, puts the scope plainly: "those sign-ins gave the attacker the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats."

The backup app was not the only one involved. In nearly 50 tenants Huntress monitors, service principals for "ConnectWise's Cloud Management apps (Exchange Online, Microsoft Teams, and Microsoft Graph) assigned themselves directory roles, mostly Exchange Administrator." In one tenant, Cloud Management - MS Teams granted itself Global Administrator and added credentials to an MSP management tool and to Huntress's own application. Those added credentials are what lets an attacker come back later.

ConnectWise disabled seven application identities at 07:00 UTC on October 17 and suspended Cloud Backup, SaaS Security, and Cloud Management. It is explicit about what that does not do: "Disabling the affected connections prevents new authentication through those connections; it does not reverse changes previously made inside a tenant." It adds that "Previously issued access tokens may remain usable until they expire or are otherwise invalidated."

On October 21, ConnectWise said "We have begun restoring services in controlled phases" and "We expect restoration to take several days." Until then, scheduled backups, archive access, and restores are unavailable for affected clients. ConnectWise says existing archives "remain encrypted, isolated, and preserved, with no indication of compromise," and is careful to separate that from live tenants. Its line on that point: "A successful sign-in alone does not establish that data was copied."

Action this week: work through every tenant you manage, including ones where the SkyKick connection has been dormant for years. ConnectWise's advisory tells partners to cover "environments with dormant SkyKick connections."

1. Preserve sign-in and audit logs first. Containment can overwrite evidence.
2. In Entra enterprise applications, confirm the seven ConnectWise identities are disabled. The Cloud Backup app ID is 506e08f9-6e9a-4da4-942b-a099a03644ae. BleepingComputer lists all seven. Older tenants may show the management apps as "SkyKick Cloud Manager."
3. Filter service principal sign-ins from October 13 onward for 144.172.64[.]128, 144.172.64[.]99, and 144.172.64[.]60.
4. Review secrets and certificates on every application for anything added since October 13, and check directory role assignments for ConnectWise or SkyKick service principals.
5. Check mailbox forwarding, inbox and transport rules, and delegated mailbox access.

Do not re-enable anything yet. ConnectWise's instruction is to "Keep affected application connections disabled until ConnectWise provides formal instructions for your service."

Two Entra controls make a planted secret harder to use next time. Huntress points to application management policies, which "can restrict or block client secrets on app registrations and cap credential lifetimes," and to Conditional Access for workload identities, "which needs additional licensing."

Advisories

AhsayCBS: the August patch did not close an exploited chain

CISA added CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (command injection) in AhsayCBS to KEV on October 14, noting the second "can be chained with CVE-2026-105133." Ahsay's October 12 notice says "our previous patches v9.15.2.59 and v10.3.4.0 did not fully address" them. The fixes are the v10.3.4.45 hotfix for v10 and the v9.15.2.70 hotfix for v7, v8, and v9, both behind a partner portal login. Huntress saw attackers drop web shells and XMRig miners, per The Hacker News.

Action: if you or a backup partner hosts AhsayCBS, confirm the exact build, apply the hotfix, and reboot. Then hunt for prior access. Bitdefender notes that "Patching closes the entry point but does not remove webshells."

BeyondTrust Remote Support zero-day was exploited since August

CVE-2026-102764 is an authentication bypass in BeyondTrust Remote Support that lets attackers perform file operations on the appliance. NVD scores it 9.8. BleepingComputer reports exploitation since late August by the group Mandiant tracks as Armory Castle, and SaaS patching on October 8. Self-hosted appliances need the BT26-05-RS patch, which covers 24.3.1 through 26.2.3. Older installs must upgrade first. Shadowserver tracks over 1,400 exposed instances.

Action: patch self-hosted appliances, then review them. Mandiant's guidance: "Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed."

October Patch Tuesday: one exploited Windows Shell bug in 1,413 fixes

Microsoft patched 1,413 vulnerabilities this month, by The Hacker News' count. One is marked exploited in the CVRF: CVE-2026-96951 in Windows Shell (CVSS 8.8), which CISA added to KEV on October 13. Microsoft says an attacker "could evade Mark of the Web (MOTW) defenses." CVE-2026-108398, a publicly disclosed .NET Framework flaw, bypasses Windows Defender Application Control. CVE-2026-21413 (CVSS 9.8) in Raw Image Extension triggers "when Windows generates a thumbnail or preview."

Action: confirm the October cumulative update reached every managed endpoint, starting with machines whose users handle email attachments.

Cisco's email gateway is on KEV again, through its malware scanner

CVE-2026-76519 (CVSS 9.8) lets an unauthenticated attacker write files and run commands as root by emailing a crafted attachment. It affects Secure Email Gateway when File Reputation is enabled and "The Content Scanner Tools version is earlier than 25.3.0.5525," per Cisco's advisory. "In October 2026, the Cisco PSIRT became aware of active exploitation." This is the second SEG bug on KEV in a month, after the one in #021.

Action: run contentscannerstatus on each appliance. Version 25.3.0.5525 or later carries the fix, and the update needs no restart. Then run grep "System Security" system_logs on every cluster member. Cloud Gateway customers need no action.

Three more edge devices joined KEV

FortiMail CVE-2026-104286 lets an unauthenticated attacker write files through the IBE feature. Fortinet fixed it in 8.0.2, 7.6.7, and 7.4.9; 7.2 users must move to 7.4. PAN-OS CVE-2026-0322 is a root RCE in the management interface for an authenticated attacker, with "very limited exploitation" reported, per The Hacker News. Ivanti Connect Secure CVE-2026-104935 lets an unauthenticated attacker run commands on versions before 25.1.3.0.

Action: patch any of the three you manage. Where FortiMail can't be upgraded today, turn off IBE, which is Fortinet's workaround.

NetScaler fixes from September need a second update

CISA added NetScaler CVE-2026-88771, which lets an unauthenticated attacker run commands, and CVE-2026-88772 to KEV on September 27. NVD lists the fixed builds as 14.1-73.37 and 13.1-64.23. A third bug, CVE-2026-88779 (denial of service), followed on October 4. Its fixed builds are later: 14.1-73.41 and 13.1-64.28.

Action: check every ADC and Gateway against the October 4 builds, not the September ones. An appliance patched in late September is still exposed to CVE-2026-88779.

Product changes

Intune ships the Windows 11 26H2 security baseline

Intune's what's new for the week of October 5 adds the Windows 11, version 26H2 baseline with "new settings, updated default values, and revised security guidance." It does not apply itself: "Existing security baseline profiles don't automatically update to the new version." The NetBIOS settings policy is left out for now.

Action: compare the new baseline against each client's customized profile before updating it, and roll it out to an IT-owned ring first.

Licensing

Copilot Business pay-as-you-go now starts December 1, with a 4,000-credit default

Microsoft moved the date. Usage-based billing for new Copilot Business licenses bought through CSP was "Previously communicated as November 2, 2026" (the date #022 reported) and now begins December 1, per the Partner Center announcement. The default spending limit "will be 4,000 Copilot Credits per user per month, which can be adjusted by admins." Microsoft's own example: a customer with 100 Copilot Business users "could consume up to 400,000 Copilot Credits per month under the default spending limit." The rollout initially excludes several markets, including Australia, France, and Germany.

Action: decide each client's spending limit before December 1 instead of inheriting the default.

Copilot SKUs drop the base-subscription requirement, and current ones are renamed

From December 1, new Microsoft 365 Copilot and Copilot Business offers "can be purchased without a qualifying Microsoft 365 base subscription," at the same price, with their own product and SKU IDs, per the same announcement. The new IDs arrive ahead of the November 1 price list preview. Since October 16, the current offers carry "(add-on)" in their names.

Action: if your PSA or license automation matches Copilot SKUs by display name, switch it to SKU IDs before the December catalog lands.

Business Premium security add-ons get a 7.5% CSP promotion

Since October 1, eligible CSP direct bill partners and distributors get "7.5% promotional Cloud Solution Provider (CSP) pricing" on Defender Suite and Purview Suite for Business Premium, for customers "with fewer than 300 seats," per the Partner Center announcement. It also reaches partner groups the previous rebate did not cover.

Action: if you quote either suite to SMB clients, check eligibility in the CSP promotion guide and build the discount into your quotes.