The Week in Tech: Cloud Backups, Patch Pressure and the New SME Security Reality

For small and mid-sized businesses, the latest technology news has one clear message: cloud convenience does not remove operational risk. It can move that risk into identity systems, backup platforms, remote access tools and third-party integrations.

Introduction

This week brought several developments that matter directly to Australian businesses and their technology providers. A major cloud backup platform was suspended after unauthorised access to application identities. A backup product vulnerability was added to the US Known Exploited Vulnerabilities catalogue. Microsoft issued its October security updates, while also warning about possible Exchange Server instability after the update cycle.

At the same time, law enforcement and technology companies reported a large phishing infrastructure takedown involving more than one billion malicious messages. The operation is a reminder that business email compromise is no longer a small-scale exercise run by individuals. Criminal groups now use automation, stolen accounts, disposable infrastructure and impersonation kits to target businesses at scale.

The practical takeaway is not that SMEs should stop using cloud services. The message is that business leaders need better visibility over access, suppliers, backups, patching and recovery. The following stories show where to focus first.

1. ConnectWise Cloud Backup suspension shows the risk of supplier access

ConnectWise has suspended its Cloud Backup service, formerly known as SkyKick Cloud Backup, after identifying unauthorised access to application identities associated with the service. The company also suspended connected SaaS Security and Cloud Management services while its investigation and remediation work continued.

According to the ConnectWise Trust Center advisory, scheduled backups, archive access and restores were unavailable during the suspension. ConnectWise said existing backup archives remained encrypted and isolated, and that it had no indication at the time of publication that those archives had been compromised. However, the company also warned that disabling affected connections would not reverse changes already made inside a customer tenant.

Independent reporting and security researchers indicated that the incident affected the Microsoft 365 environments managed through some partner and customer tenants. The issue was especially significant because the application identities used by a backup service may hold broad permissions across email, files, SharePoint and directory services.

Why it matters for businesses

Many SMEs assume their managed service provider or backup supplier is a protective layer that can be trusted without further checks. In reality, supplier access can become a powerful pathway into a customer environment. If a service account has broad permissions, an attacker may use it to read data, change roles, create persistence or interfere with recovery processes.

The incident also highlights a common business continuity problem. A backup service can be secure in principle, yet unavailable during the exact period when an organisation needs to restore data. A single cloud backup platform may protect many customers, but it can also create concentration risk.

Practical recommendations

• Ask your IT provider whether your Microsoft 365 or Google Workspace backup platform was affected, and request a written status update.
• Review application identities, enterprise applications, OAuth grants and service principals in your cloud tenant.
• Check audit logs for unexpected sign-ins, role assignments, mailbox forwarding rules, consent changes and unusual data access.
• Confirm that your backup plan includes a second recovery path, such as an independent backup, offline copy or provider with separate administrative credentials.
• Test a restore of important email, documents and line-of-business data instead of relying only on a successful backup status.

The central lesson is simple: third-party access should be treated as part of your security perimeter. Vendor assurance is useful, but it does not replace tenant-level monitoring and recovery testing.

2. Backup software vulnerabilities are being exploited quickly

Security researchers reported active exploitation of two vulnerabilities affecting AhsayCBS, a backup management platform used by businesses and IT service providers. The vulnerabilities, CVE-2026-105133 and CVE-2026-105134, were added to the US Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities catalogue on October 14.

According to a vendor security update and a technical advisory from Bitdefender, attackers were exploiting the issues in the wild. The reporting also stressed that installing a patch may not remove web shells, malicious accounts or other access already established by an attacker.

Ahsay released updated fixes on October 12 after earlier versions did not fully address the vulnerabilities. The incident demonstrates why backup systems need the same urgency as internet-facing firewalls, VPNs and email gateways. They are not passive storage tools. They often have privileged access to servers, endpoints, databases and cloud accounts.

Why it matters for businesses

Backup infrastructure is attractive to attackers because it can provide visibility into valuable business data and, in some cases, a route to disable recovery. If criminals can compromise the system that manages backups, they may be able to steal information, plant persistence or disrupt restoration before launching ransomware or extortion.

For SMEs, the risk is amplified when backup administration is delegated to a provider without clear responsibility for patching, log review and incident response. A business may believe its backups are protected while the management console remains exposed to the internet.

Practical recommendations

• Identify every product used to back up endpoints, servers, virtual machines, SaaS data and databases.
• Confirm the exact product version and whether the vendor has issued a security fix or superseding hotfix.
• Prioritise internet-facing backup management consoles and remote administration interfaces.
• After patching, look for unknown users, web shells, unusual processes, new scheduled tasks and unexpected outbound traffic.
• Maintain at least one backup copy that is isolated from normal administrative credentials and cannot be deleted from the main tenant.

The broader point is that patching is only one stage of response. When a vulnerability has been exploited, businesses need a short investigation, not just a software update. If you cannot perform that review internally, ask your IT provider or incident response partner to do it and document the result.

3. Microsoft updates bring security fixes, lifecycle changes and operational testing requirements

Microsoft released its October 2026 security updates on October 13. The company advised organisations to install the updates promptly across supported Windows versions. At the same time, some Windows editions reached the end of updates, while Windows Server 2022 moved from mainstream support into extended support.

Microsoft also reported customer issues involving some Exchange Server environments after the October update cycle. According to the Microsoft Exchange advisory, reported symptoms included unstable Outlook on the web access, growing email queues and database availability problems. The company said the reports were not caused by the security updates themselves, but the timing means administrators should test carefully and monitor affected systems.

The Microsoft Windows release information also confirms that Windows 11 version 24H2 Home and Pro editions reached the end of updates on October 13. Windows Server 2022 has moved into extended support, while Windows Server 2025 is the current long-term servicing release.

Why it matters for businesses

SMEs often delay patching because they fear downtime or compatibility problems. That creates a difficult trade-off, particularly when updates address vulnerabilities that attackers may exploit. The answer is not to avoid updates. It is to create a repeatable process that combines risk-based prioritisation, testing, staged deployment and rollback planning.

Lifecycle dates matter just as much. A device that no longer receives security updates becomes a permanent exception that needs additional controls, replacement funding or a formal migration plan. Unsupported systems can also create problems during insurance renewals, customer due diligence and compliance reviews.

Practical recommendations

• Confirm which Windows editions, servers and business applications are installed across the organisation.
• Apply the October security updates through a staged process, beginning with a test group and critical internet-facing systems.
• Monitor Exchange queues, mail flow, authentication and user reports after updates are installed.
• Create a replacement or upgrade plan for devices and server platforms approaching or already beyond support boundaries.
• Keep a short record of testing, exceptions and remediation dates so management can see where risk remains.

For Australian organisations, this is also a good time to review whether patching responsibilities are clear under supplier contracts. If an MSP manages updates, the agreement should state which systems are covered, how quickly urgent fixes are applied and how failed updates are handled.

4. A large phishing takedown does not mean phishing risk has gone away

Microsoft has described a coordinated disruption involving the YAM Store, CoGUI and Iron Man cybercrime ecosystem. According to the Microsoft cybercrime disruption report, the services supplied stolen accounts, impersonation tools and infrastructure used in scams and credential theft. Microsoft said the ecosystem enabled more than one billion malicious messages globally since January 2026, including more than 750 million sent to Microsoft customers.

The operation involved private-sector security companies and law enforcement agencies in several countries. It targeted the infrastructure and service providers that help criminals create convincing phishing campaigns, rather than focusing only on individual messages.

Why it matters for businesses

A takedown can disrupt criminal operations, but it does not remove the underlying business risk. Criminal groups can replace domains, register new accounts and modify templates quickly. Generative AI also makes it easier to personalise messages, imitate writing styles and produce convincing business impersonation content.

The risk is not limited to stolen passwords. A successful phishing attack may result in fraudulent invoices, payroll changes, unauthorised mailbox rules, cloud data theft or a compromised supplier account. For a small business, one successful payment diversion can create more immediate damage than a technical outage.

Practical recommendations

• Require phishing-resistant MFA or passkeys for administrators, finance staff and users with access to sensitive systems.
• Train employees to verify payment changes and urgent requests using a second communication channel.
• Configure email authentication controls, including SPF, DKIM and DMARC, and monitor failures.
• Review mailbox forwarding rules, delegated access and suspicious consent grants every month.
• Make it easy for staff to report suspicious messages without fear of blame or disciplinary action.

Security awareness training works best when it is connected to business processes. Finance teams need payment verification rules. Managers need clear escalation paths. IT teams need logs and alerts. Everyone should know what to do when a suspicious message is opened or credentials may have been entered.

5. Remote access and support tools remain high-value targets

This week also saw continuing attention on a critical BeyondTrust Remote Support vulnerability, tracked as CVE-2026-102764. BeyondTrust issued a patch for SaaS and self-hosted customers, and its advisory states that the SaaS environment had been patched by October 9.

The BeyondTrust security advisory describes the issue and the required remediation steps. Security reporting indicated that attackers had been exploiting the vulnerability before public disclosure, making it important for administrators to investigate historical activity rather than assuming the patch alone resolved the risk.

Why it matters for businesses

Remote support tools are essential for many SMEs, particularly where an MSP manages workstations, servers and cloud services. They also provide a privileged path into the environment. If an attacker obtains control of the tool, they may be able to operate with the same trust as a legitimate technician.

A remote access product can therefore become a supply-chain risk, an identity risk and an endpoint risk at the same time. The smaller the IT team, the more important it is to keep the tool tightly controlled and well monitored.

Practical recommendations

• Maintain an inventory of remote support and remote administration products, including tools installed by suppliers.
• Restrict access by role, device, time and network location wherever the product allows it.
• Require MFA and separate administrator accounts from ordinary user accounts.
• Review technician activity, session recordings, new accounts, privilege changes and unusual commands.
• When a critical flaw is disclosed, check logs from the earliest known exploitation date, not only from the patch date.

The goal is not to eliminate remote support. It is to make every privileged session visible, attributable and revocable.

What This Means For Your Business

This week’s stories point to a common pattern. The most serious risks are increasingly found in trusted systems that businesses use every day: cloud backup, Microsoft 365, remote support, email and patch management. Attackers do not always need to break through a perimeter when they can abuse a legitimate application identity or a supplier relationship.

Start with a practical 30-day review. List your critical SaaS platforms, backup products, remote access tools and internet-facing systems. For each one, record the owner, administrator, supplier, MFA status, backup arrangements, patch process and recovery test date. This simple register will expose gaps that are often hidden across several vendors.

Next, prioritise identity and recovery. Remove stale accounts and application permissions, protect administrator accounts, test your most important restores and make sure at least one recovery copy is separated from everyday credentials. Ask suppliers for clear answers about incidents, logging, notification and responsibility for remediation.

Good cybersecurity for an SME is not about buying every new product. It is about knowing what you depend on, reducing unnecessary access, applying important fixes quickly and practising how the business will continue if a trusted service is unavailable. Those actions improve security, resilience, compliance and customer confidence at the same time.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.