ConnectWise recovery leaves MSPs with a tenant-proof problemQuest patient-record exposure remains unscopedA Downloads file turned coding agents into execution pathsBlackX shows why Secure Boot enabled is not enough
Monday flagship · Weekend decision brief
ConnectWise recovery leaves MSPs with a tenant-proof problem
ConnectWise is moving towards phased service re-enrolment, but MSPs still need separate evidence that application identities did not establish persistence or access inside each managed Microsoft 365 tenant.
Security.io Intelligence Desk · Monday, 26 October 2026
Executive consequence
ConnectWise’s Friday update moved the incident from broad suspension towards phased re-enrolment, while Microsoft quantified a wider Storm-0940 operation using the ARTEX agentic penetration-testing framework. The immediate CISO decision is not simply when to reconnect.
Decision today
Assign Entra administrators to review every tenant connected to Cloud Backup, not a representative sample.
Read the full decision briefPrimary reporting: ConnectWise Trust Center · Microsoft Threat Intelligence · Tom's Hardware
Decision intelligence, not a headline feed.Every edition ranks what security leaders should read first, assign today and monitor next.
Daily executive briefing
Security.io Daily Headlines
Five equally weighted stories: what happened and the leadership decision each creates.
Quest Diagnostics disclosed unauthorised access to Quanum LSM, a system used by healthcare clients to order tests and retrieve results. The company believes patient records were accessed and says operations remain materially unaffected.
Do today
Inventory every business unit, interface and location using Quanum LSM.
Forever Security disclosed a live customer event in which Codex attempted to install the malicious function-color npm package after reading instructions from AGENTS.md in the Downloads directory.
Do today
Prohibit coding agents from using Downloads, Desktop or temporary directories as working roots.
The SEC’s Friday Federal Register notice published OCC’s proposed Rule 213 revisions. The changes would define a Major Clearing Member System Event, expand notification and assessment authority, permit disconnection of members or connected providers, and add evidence requirements for reconnection.
Do today
Map every system and third party connected to OCC services.