Cybersecurity News This Week: Why Backup Systems, MSPs and Remote Tools Are in the Firing Line

A quiet week in cybersecurity is becoming the exception rather than the rule. Over the past seven days, attackers have targeted the systems businesses rely on for backup, remote support, Microsoft 365 administration and software delivery.

For small and mid-sized organisations, the message is practical rather than dramatic: trusted tools can become high-value entry points, and a vulnerability is only as manageable as the speed and discipline of the response.

The big picture: trust is becoming the attack surface

The latest incidents have a common thread. Attackers are not always breaking through an obvious perimeter. They are abusing legitimate applications, supplier relationships, service accounts and management platforms that already have access to sensitive systems.

That makes these incidents especially relevant to Australian businesses that rely on managed service providers, cloud platforms and outsourced IT support. A company may have strong endpoint protection and still be exposed through a trusted application with excessive permissions or an internet-facing appliance that has not been patched.

The encouraging news is that the practical controls are familiar. Organisations can reduce their exposure by tightening third-party access, accelerating critical patching, separating backup systems and monitoring for unusual sign-ins or application behaviour.

1. ConnectWise Cloud Backup incident puts Microsoft 365 supply chains under scrutiny

On October 16 and October 17, ConnectWise said it had identified unauthorised access to application identities associated with its Cloud Backup service, formerly known as SkyKick Cloud Backup. The company suspended the service and revoked certificates used for affected application connections while its investigation continued.

Microsoft described the activity as a supply-chain attack involving the Cloud Backup application. Huntress reported that it had identified at least 162 compromised Microsoft 365 tenants in its environment. ConnectWise said it had no indicators at that stage that partner backup data had been compromised, but customers were advised to review their environments with security teams or managed service providers.

The incident matters because cloud applications can hold broad permissions. An application identity may be able to read mailboxes, access files, inspect directories or make changes across an entire tenant. If those permissions are abused, the attacker may not need to steal a user password at all.

According to ConnectWise’s trust centre updates, customers should review Microsoft Entra service principal sign-ins and investigate activity from unexpected locations. A technical report from BleepingComputer also described the incident as affecting Microsoft 365 tenants through the trusted backup connection.

Why it matters for businesses

Small businesses often assume that a reputable supplier absorbs most of the security risk. In reality, outsourcing changes the risk profile but does not remove it. Your organisation remains responsible for knowing which suppliers have access, why they need it and how quickly that access can be withdrawn.

The operational impact is also important. When a backup provider is shut down as a containment measure, customers may temporarily lose backup coverage even if their existing archives remain intact. That creates a business continuity problem at exactly the time when confidence in the provider is under pressure.

Practical actions

• Review every Microsoft 365 application registration and service principal with tenant-wide or directory-wide permissions.
• Ask your MSP or backup provider which permissions its application requires and whether they can be reduced.
• Check Entra sign-in logs for unusual service principal activity, unfamiliar IP addresses and unexpected permission changes.
• Ensure emergency admin accounts are protected by phishing-resistant MFA and are not dependent on the affected application.
• Confirm that you have a second recovery path for Microsoft 365 data, including a documented export or restoration process.

2. BeyondTrust zero-day highlights the risk of remote support tools

BeyondTrust disclosed a critical vulnerability in its Remote Support product on October 15. The flaw, tracked as CVE-2026-102764, was rated 9.3 under CVSS v4 and could allow a remote attacker to perform file operations on an affected appliance.

BeyondTrust said the flaw had been exploited in the wild before public disclosure. The company linked the activity to a suspected China-nexus espionage group tracked by security researchers as Armory Castle, with other researchers using the name Warp Panda. The affected product is used by IT help desks and support teams to remotely troubleshoot customer and employee systems.

SaaS customers were patched by the provider, while self-hosted customers were required to apply the patch manually unless automatic updates were enabled. The BeyondTrust security advisory lists affected versions and the required remediation. The company’s technical analysis of the incident also recommends urgent action for self-hosted Remote Support and Privileged Remote Access customers.

Why it matters for businesses

Remote support tools are powerful by design. They can connect technicians to servers, install software, transfer files and assist users without someone being physically present. That same capability makes them attractive to attackers seeking persistence or access to other systems.

For small organisations, the greatest risk may sit with an MSP or outsourced support provider. A business may not operate BeyondTrust itself, but its provider could use the platform to reach the business network. This is why supplier security needs to be treated as an operational control, not just a procurement checkbox.

A successful compromise of a remote support platform can also be difficult to spot. Activity may appear to come from a legitimate administrator or trusted tool. Traditional antivirus alerts may not fire when the attacker is using the platform’s normal functions.

Practical actions

• Ask your IT provider whether it uses BeyondTrust Remote Support, Privileged Remote Access or another remote administration platform.
• Confirm that all self-hosted appliances are patched and that unused remote access accounts have been disabled.
• Require MFA, named administrator accounts and approval workflows for high-risk remote sessions.
• Review remote session logs for unusual times, destinations, file transfers and administrator behaviour.
• Restrict management interfaces from direct internet exposure wherever practical.

3. AhsayCBS attacks show why backup servers must be isolated

Attackers have been exploiting two newly disclosed flaws in Ahsay Cloud Backup Suite, a backup management platform used by service providers and system integrators. Security researchers observed the flaws being chained to gain control of exposed backup servers, install web shells and run cryptocurrency-mining malware disguised as Microsoft Edge components.

The campaign was reported after exploitation began in early October. Huntress observed attacks against multiple organisations, while additional reporting described attackers using the compromised servers to run XMRig miners and establish persistence. A technical investigation from Hive Security described the backup console as the initial foothold and noted that the visible mining activity may be less important than the access the attackers gained.

A recent industry report on the campaign said the attackers used CVE-2026-105133 and CVE-2026-105134. The first vulnerability enabled authentication bypass, while the second allowed command execution. Together, they created a path to take over exposed servers.

Why it matters for businesses

Cryptocurrency mining may sound like a nuisance compared with ransomware, but it can be a warning sign that an important system has been compromised. A backup server often contains credentials, network access and a map of the organisation’s recovery environment.

If an attacker controls the backup platform, they may be able to delete backups, alter retention settings, steal credentials or use the system to move deeper into the network. In a ransomware scenario, that can turn a difficult recovery into a much longer outage.

Backup systems also tend to receive less day-to-day scrutiny than production servers. They may be excluded from endpoint monitoring, left reachable from the internet or trusted without sufficient segmentation. The assumption that a backup server is only defensive is no longer safe.

Practical actions

• Identify every backup management console, replication receiver and backup agent exposed to the internet.
• Apply the vendor’s current hotfixes and mitigations, then verify the running version rather than relying on an update ticket.
• Place backup infrastructure on a separate network with tightly controlled administrative paths.
• Use immutable or offline backup copies that cannot be altered through the same administrator account used for production systems.
• Test restoration regularly and investigate unexplained CPU usage, new services, web shells, PowerShell activity or unexpected administrator accounts.

4. GitLab’s critical CI/CD flaw is a reminder to secure the software pipeline

GitLab released critical security updates on October 12 for self-managed GitLab installations. The main issue, CVE-2026-97229, was an integer overflow in the CI/CD regular expression compiler. Under certain conditions, an unauthenticated attacker could execute arbitrary code on the GitLab server through a specially crafted expression.

GitLab rated the vulnerability at CVSS 10.0 and released fixes in versions 19.2.8, 19.3.5 and 19.4.2. GitLab’s official patch release said GitLab.com had already been remediated, while self-managed customers needed to update their own environments.

The issue is particularly relevant to businesses that maintain private source code repositories, automated build systems or internal deployment pipelines. A compromised CI/CD server may expose source code, secrets, signing keys, cloud credentials and production deployment permissions.

Why it matters for businesses

Software development platforms are increasingly part of the business security boundary. They are not just places where code is stored. They may also control how applications are built, tested, signed and deployed.

A small business may not have a large development team, but it may still run GitLab for customer portals, internal applications, automation scripts or infrastructure configuration. If the platform is internet-facing and self-managed, patching delays can create a direct path to valuable credentials.

This is also a reminder that security teams need visibility across development and IT operations. A vulnerability in a build platform may not be noticed by an endpoint security product or a conventional server patching report.

Practical actions

• Confirm whether your organisation, contractor or development partner operates self-managed GitLab.
• Update affected installations immediately and verify that the patched version is running.
• Rotate CI/CD variables, deploy keys, runner tokens and cloud credentials if compromise cannot be ruled out.
• Restrict runners and build agents so they cannot access more systems than they need.
• Add repository, pipeline and administrator activity to central logging and alert on unusual changes.

The common lesson: critical access deserves critical controls

These stories look different on the surface. One involves a cloud backup provider, another a remote support appliance, another a backup management platform and another a developer tool. The common factor is privileged access.

Each product can reach more than a normal user account. Each can influence systems, data or recovery processes. That is why these platforms should be treated as part of the organisation’s identity and access management programme, not as isolated specialist products.

A useful review question for every high-value tool is simple: if this application were compromised tonight, what could an attacker do without needing another password? The answer should guide segmentation, permission reduction, logging and incident response planning.

What This Means For Your Business

The cybersecurity news from the week of October 12 to October 19, 2026 is a reminder that resilience depends on more than buying security software. It depends on knowing which platforms have privileged access, keeping them current and having a recovery plan that still works when a trusted supplier or management tool is unavailable.

Business leaders do not need to become vulnerability researchers. They do need a short, repeatable process. Ask your IT team or provider to review critical remote access tools, backup consoles, Microsoft 365 application permissions and self-managed development platforms. Ask for evidence of patching, not just an assurance that updates are handled.

Then test the basics. Can an administrator revoke a supplier’s access quickly? Can the business restore important files without the production domain? Are service account sign-ins monitored? Can staff contact customers and continue essential operations during a cloud outage? These questions turn cybersecurity from a technical concern into a business capability.

The organisations that respond best are not necessarily those with the biggest security budgets. They are the ones that understand their dependencies, reduce unnecessary access and practise recovery before an incident forces the issue.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.