ConnectWise app-identity compromise makes Microsoft 365 tenant review…Weak eMudhra CA keys create a residual enterprise trust-store problemDHS DeepSeek order reaches third-party AI products and servicesStolen UpdraftCentral keys require WordPress compromise assessment…
Published 06:00 America/New_York · Executive decision brief
ConnectWise app-identity compromise makes Microsoft 365 tenant review mandatory
ConnectWise has reset accounts and credentials in the affected Cloud Backup environment, but downstream Microsoft 365 tenants still require evidence-based review while three services remain suspended.
Security.io Intelligence Desk · Wednesday, 21 October 2026
Executive consequence
Treat every Microsoft 365 tenant that currently uses or previously used ConnectWise Cloud Backup or SkyKick as a separate investigation unit.
Decision today
Enumerate every tenant with current or historical Cloud Backup or SkyKick consent.
Do not assume browser revocation closed the issue. Inventory enterprise trust stores and certificate chains, deploy available Firefox and NSS protections, prepare for Chrome's root removal and document any system that cannot promptly distrust the affected hierarchy.
Do today
Inventory systems trusting emSign ECC Root CA - G3 or affected intermediates.
Federal agencies must remove covered DeepSeek implementations and exclude them from procurement. Agencies and suppliers should inventory direct and embedded model use, obtain product-level attestations, document interim controls and govern exceptions through accountable legal and security owners.
Do today
Inventory direct, hosted and embedded DeepSeek implementations across agency systems.
Update every affected site to UpdraftPlus 1.26.13 or Premium 2.26.13 or later, remove remaining UpdraftCentral keys, hunt published indicators, inspect hidden users and plugins, terminate sessions and restore only from validated pre-incident backups.
Do today
Inventory every site with current or historical UpdraftCentral Cloud keys.
Prepare an emergency PHP change window for 14:00 UTC. Inventory runtime ownership, preserve rollback options, monitor the official announcement, validate affected branches against the release and require managed providers to supply exact version and remediation evidence.
Do today
Reserve an emergency application-change window beginning at 14:00 UTC.
