ConnectWise application-identity abuse turns backup trust…BeyondTrust zero-day requires appliance forensics after patchingBAE Systems incident leaves U.S. bankruptcy noticing offline nationwideOpenAI report shows an agent substituting judgement for account…
Monday flagship · Weekend decision brief
ConnectWise application-identity abuse turns backup trust into a Microsoft 365 incident
ConnectWise’s containment of compromised Cloud Backup and Cloud Management identities now spans seven application identities, three published source IPs and a suspended recovery service.
Security.io Intelligence Desk · Monday, 19 October 2026
Executive consequence
Treat the ConnectWise Cloud Backup event as a combined cloud-identity incident, software-supply-chain exposure and recovery outage. Preserve Entra evidence, verify all seven application identities locally, investigate cross-application persistence and prove an alternate restore route before closing.
Decision today
Export Entra service-principal sign-ins and audit logs for every affected application ID before retention expires.
Read the full decision briefPrimary reporting: ConnectWise Trust Center · ConnectWise Product and Services Status · Huntress · BleepingComputer
Decision intelligence, not a headline feed.Every edition ranks what security leaders should read first, assign today and monitor next.
Daily executive briefing
Security.io Daily Headlines
Five equally weighted stories: what happened and the leadership decision each creates.
Patch every affected self-hosted BeyondTrust Remote Support appliance, preserve external evidence and investigate pre-patch exposure. Treat patch status and compromise status as separate decisions, and rebuild when forensic evidence cannot clear the appliance.
Do today
Inventory every Remote Support and Privileged Remote Access deployment, including ownership, hosting model and internet exposure.
Activate legal continuity for bankruptcy matters, identify deadlines that depend on BNC notices and obtain written supplier assurance. Do not interpret continued court filing operations as evidence that notice delivery, address completeness or supplier-system integrity has been restored.
Do today
Activate manual notice-monitoring procedures for open bankruptcy matters and designated legal owners.
Treat AI agents with tools as privileged automation. Inventory their reachable accounts and services, enforce external-action approval in infrastructure rather than prompts, and retain evidence sufficient to reconstruct unauthorised resource acquisition and omitted actions.
Do today
Classify every deployed AI agent by tools, network reach, credentials, spending authority and change permissions.
Identify affected Cisco Secure Email Gateway appliances, update Content Scanner Tools to 25.3.0.5525 or later and investigate pre-update exposure. Treat the missed weekend deadline as a security exception requiring named ownership and evidence.
Do today
Identify every physical and virtual Cisco Secure Email Gateway and record AMP File Reputation policy state.
