[connectwise]

October 25, 2026

• Storm-0940 drove the ConnectWise intrusions with the open-source AI pentest framework ARTEX at machine speed. Microsoft says the China-linked actor hit over 300 accounts across eight organisations at more than 2,900 attempts per minute, then used ARTEX to attempt sign-ins to more than 2,250 tenants, generating 151,000+ failed logon events. In some environments the agents progressed past authentication into Microsoft Graph and directory operations — reconnaissance, application credential modification for persistence, and changes to identities, groups and privileged roles, ensuring access survives remediation of the original app. (SecurityWeek) · Threat Activity

in When the Red Team Is the Model: OpenAI's Agents Escaped Their Own Sandbox

October 22, 2026

• Microsoft now assesses that China-aligned Storm-0940 conducted the ConnectWise Cloud Backup compromise using ARTEX. Since September, the actor targeted hundreds of organizations globally; several attacks reached privileged cloud access, and multiple did so in under three hours. ARTEX used compromised, previously consented application credentials to enter Microsoft 365 without an interactive sign-in, followed by Graph reconnaissance, credential changes and privilege attempts. Successful authentication does not itself prove data access or exfiltration. The attribution and agentic workflow are new since earlier coverage; see Microsoft’s analysis. · Cloud, Identity & Threat Activity

in PHP2Shell Is Already in the Wild

October 21, 2026

• ConnectWise reset accounts and replaced application credentials after the Cloud Backup identity compromise. It has also strengthened administrative-access protections, though Cloud Backup remained offline in the latest update. This is a remediation development to the incident covered on October 18 (earlier coverage); The Hacker News has the new actions. · Cloud & Software Supply Chain

in PHP’s php2shell RCEs Break Cover

October 18, 2026

• ConnectWise Cloud Backup (formerly SkyKick) is the pivot in an active Microsoft 365 supply-chain compromise. Microsoft Threat Intelligence says the actor abused the multitenant app's existing consent — including Directory.ReadWrite.All — to obtain access tokens, observing broad successful service-principal authentication from 144.172.64[.]128 on October 15, followed by Microsoft Graph reconnaissance and attempts to add new credentials to the service principal as a backdoor, which survives revocation of the original compromised credential (Microsoft Threat Intelligence). The app ID is 506e08f9-6e9a-4da4-942b-a099a03644ae; observed user agents are Python-urllib/3.12 and python-requests/2.31/2.34.2. Huntress, which raised the alarm on October 16, says the actor signed into 173 tenants, up from its initial 162 (Huntress, BleepingComputer, The Hacker News). · Cloud & Identity

in One Backup App's OAuth Grant Opened Hundreds of Microsoft 365 Tenants

September 17, 2026

• ConnectWise ScreenConnect exploitation now has a CVE and a KEV entry: CVE-2026-84869, an improper-privilege-management and missing-authorization pair allowing file transfer and execution through an active remote session without host confirmation, fixed in 26.6.5. Shadowserver still tracks over 1,000 exposed unpatched instances — 758 in North America, 180 in Europe (earlier coverage). BleepingComputer. · Active Exploitation

in One Extension Hijacks the AI Assistant in Five Major Browsers

September 15, 2026

• ScreenConnect exploitation is now documented as worm-like. Huntress first saw attacks on August 20 in which social-engineered, modified clients automatically pushed scripts into newly connected sessions, SecurityWeek reports. CVE-2026-84869 affects clients before 26.6.5, not servers; ConnectWise says operators must reinstall host clients and update access agents after upgrading. (earlier coverage) · Exploitation & Vulnerability Research

in Scope Questions Recast Anthropic’s “Rogue Agent” Incidents

September 8, 2026

• ConnectWise ScreenConnect has an unpatched flaw in file-transfer behaviour affecting both cloud and on-prem, with no CVE assigned and a fix promised later this week. The interim mitigation is to deselect the TransferFiles (or legacy TransferFilesInSession) scoped permission on every role and session group. Shadowserver tracks nearly 6,000 internet-exposed instances (BleepingComputer). Separately, Huntress detailed the worm-like rogue-client activity from three unrelated August incidents: a four-stage VBScript chain (1.vbs–4.vbs) where stage one profiles RAM, checks for existing ScreenConnect installs and enumerates Cisco AMP, CrowdStrike, Huntress, Malwarebytes, SentinelOne, Sophos and Symantec into a three-bit state variable in %TEMP%\value.txt (The Hacker News, earlier coverage). · Vulnerabilities & Exploits

in N-able Ships a Fourth N-central Hotfix in Five Weeks — and Can't Agree Whether It's Exploited