October 18, 2026

When Security Tools Become the Attack Path

Mike York Weekly Digest AhsayCBS, Backups, BeyondTrust, ConnectWise, Magento, Microsoft Entra ID, Spyware, Windows Server, WordPress

This was a week of security tools under attack, and the uncomfortable lesson is that the tool you bought to reduce risk may be one of the most powerful ways into the business. Backup platforms can read enormous amounts of data. Remote-support systems can control machines. Security appliances sit at the edge of the network. Give an attacker control of one of those systems and they don’t need to pick every lock. You’ve handed them the master key ring.

That isn’t an argument against backups, remote support, or security tools. We need them. It is an argument against treating them as invisible plumbing. The companies providing those services need serious security, and customers need a recovery plan that still works when the recovery vendor is the one having the emergency.

The Big Story: The backup can be safe while recovery is unavailable

ConnectWise disclosed unauthorized access to application identities associated with its Cloud Backup service, formerly known as SkyKick. Those identities are software accounts used by the service to connect to Microsoft 365. They are not ordinary employee logins. They are more like digital service badges, and the entire point is to let software work without a person signing in every time.

That convenience comes with power. Depending on the permission granted, an application identity may be able to read mail, copy SharePoint and OneDrive files, inspect Teams data, or manage parts of a Microsoft 365 tenant. Huntress said it confirmed unauthorized sign-ins across 162 customer tenants by Thursday evening. ConnectWise then disabled seven affected application identities and revoked certificates used by the service.

As of ConnectWise’s Sunday update, scheduled backups were not running, access to affected archives was unavailable, and customers couldn’t restore from those archives. ConnectWise said the stored archives remained encrypted, isolated, and preserved, with no evidence that they had been accessed. It also said it could not determine from its own systems whether every downstream Microsoft 365 tenant had been touched. Those are careful distinctions, and they matter.

Backups & recovery

Backups are comforting right up until you need one. Raymond Tec helps small businesses build practical backup and recovery plans — including the decidedly unglamorous part where we make sure the thing can actually be restored.

A backup is a copy, authority, and a path back

We tend to talk about a backup as if it is a box of files. In practice, a useful backup has at least three parts. There is the copy itself. There is the authority that decides who can create, read, delete, or restore it. And there is the recovery path, meaning the software, credentials, people, and procedures needed to put the data back where it belongs.

One of those pieces can fail while the others remain intact. In this case, ConnectWise says the archives are preserved, but the normal path to reach and restore them is unavailable while the company investigates. Meanwhile, the same vendor identities that performed backup work may have been abused against live Microsoft 365 environments. Safe archive, interrupted recovery, uncertain live-system activity. All three can be true at the same time.

Here’s a hypothetical example. A ten-person company has Microsoft 365 backup through its IT provider. A staff member accidentally deletes a folder during the outage. The copy from Friday may still exist perfectly safely in the provider’s archive. But if the restore console is offline, that company still cannot get the folder back on Monday morning. Now add a separate question: did the stolen application credential create a mailbox rule or grant another identity access before it was disabled? The existence of an encrypted backup doesn’t answer that.

The most trusted systems deserve the most suspicion

ConnectWise was not alone this week. BeyondTrust said attackers exploited a serious flaw in its Remote Support product. A compromised remote-support appliance can provide root-level control, reach managed machines, and potentially erase the logs needed to reconstruct what happened. Cloud customers were patched by BeyondTrust, while organizations running the product themselves need the vendor’s BT26-05 patch and an investigation, not just a reassuring green check mark.

Ahsay also issued new fixes for two flaws in its backup server after earlier patches proved incomplete. The vulnerable server is supposed to protect other systems, yet the exploit chain could let an unauthenticated attacker execute code on the backup platform itself. That is not a cute bit of irony. If an attacker can alter the service that stores or restores your clean copies, then confidence in recovery becomes an evidence problem.

Technical discovery & auditing

The public page doesn’t tell you much about the machinery behind it. Raymond Tec audits inherited and long-running projects to uncover the plugins, integrations, data, dependencies, and old decisions that determine what the next change will really involve.

This is why I keep coming back to a simple question: who can erase the backups as well as the live system? If the same identity, management console, or vendor connection controls both, you have efficiency but not much independence. The phrase “air-gapped” gets thrown around, sometimes by people who seem to think saying it loudly creates an air gap. What matters is whether a compromised administrator, application identity, or vendor account can reach every copy and every restore control.

What a small business should ask on Monday

If you use ConnectWise Cloud Backup, this is active incident response. Your IT provider should keep the affected applications disabled, preserve the available sign-in and audit logs, and review activity from October 13 forward. ConnectWise specifically warns that deleting the application first can destroy useful evidence. It also warns that a clean search cannot prove nothing happened, because some activity may not have been logged.

If you are not a system administrator, don’t try to interpret raw service-principal logs yourself. Ask the person responsible for your Microsoft 365 environment five questions: Were we in the affected group? What is our last known-good recovery point? Are new backups running? Can we restore without the vendor’s primary console? And did you check for new credentials, changed permissions, forwarding rules, and other access that could survive after the original connection was disabled?

For administrators and managed service providers, the longer-term work is broader. Inventory privileged applications, record what each can do, collect logs somewhere the managed system cannot erase, test restores, and keep at least one recovery route outside the same control plane. “We have backups” is a starting statement. “We restored this system last quarter using credentials and infrastructure that an attacker in production couldn’t reach” is evidence.

No product makes this risk disappear. Independent copies cost money. Extra identities and offline procedures add work. Restricting permissions may make integrations less convenient. Those are real tradeoffs, but so is discovering during an incident that the emergency exit is locked from the same control panel that is on fire.

Online advertising became a zero-click delivery system

Citizen Lab and Confiant published the first public technical confirmation of mercenary spyware delivered through targeted advertising with no click required. The campaign, called AdFection by the researchers, targeted 45 Al Jazeera devices. It used the plumbing of online advertising to identify particular people and deliver an exploit through an ad placement.

This is different from the familiar malicious ad that tricks someone into downloading a fake program. That still happened this week too, with ads leading to fake Claude installers. In the AdFection case, the advertising system itself was used as a targeting and delivery channel. Ad auctions expose identifiers, location information, IP addresses, device details, and other signals to multiple participants in a fraction of a second. The ad then brings code to the browser. Put precise targeting together with a browser exploit and an attacker may not need the victim to click anything.

The rules around technology matter too

Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.

The researchers found the operation’s infrastructure across nearly 200,000 websites and apps and analyzed roughly four billion bid records. That does not mean four billion people were infected. It shows how much reach the delivery system had and how hard it is for one publisher or user to see the whole operation. After disclosure, major advertising participants disconnected the company the researchers linked to the campaign.

For ordinary users, an ad blocker is now easier to defend as a security control, not merely an aesthetic preference. Browser and operating-system updates still matter because an ad blocker cannot patch the underlying exploit. High-risk people need stronger protection, including hardened browser settings and, on supported Apple devices, Lockdown Mode. For a small business, the practical question is whether your browsing policy treats ads as executable third-party content or just marketing clutter. The first description is less comfortable, but more accurate.

Website owners got two different patching lessons

Adobe released a fix Monday for a critical Adobe Commerce and Magento Open Source flaw nicknamed BlockStrap. Security firm Sansec said it reproduced four routes to unauthenticated remote code execution. Adobe said it had no evidence of exploitation when its bulletin was published. That distinction should lower the temperature, not the priority. An unauthenticated flaw that can lead to code execution on an ecommerce server is exactly the kind of problem attackers tend to automate once they understand it.

The awkward part is the update path. Store operators need the October security release or manual patch, and they must preserve the separate September fix identified as VULN-39341. Installing one without the other can leave a gap. If a vendor note requires a paragraph to explain which combination of patches produces a safe result, this is not a “click update and forget it” situation. Verify the installed versions and the actual fix state.

WordPress security & maintenance

Keeping WordPress current is only part of keeping it healthy. Raymond Tec handles updates, backups, security monitoring, compatibility problems, access cleanup, and maintenance — plus the assorted weirdness that accumulates on a site over time.

WordPress site owners had a more urgent case. Attackers were already exploiting a flaw in the Bricksforge plugin before many site owners had patched. The fix is version 3.1.8.10 or later. Updating closes the door, but it does not remove someone who came through yesterday. Affected sites need a review for unexpected administrator accounts, suspicious PHP files in upload directories, unfamiliar scheduled tasks, and log activity that does not match normal use.

These incidents make the same point from opposite directions. With BlockStrap, there was no known exploitation at disclosure, so prompt patching can keep a vulnerability from becoming an incident. With Bricksforge, exploitation was already underway, so patching and investigation are separate jobs. A fixed lock does not tell you whether somebody entered while it was broken.

Installing the update is not the end of the update

Microsoft’s October Windows updates closed an actively exploited way to bypass Mark of the Web, the warning Windows attaches to files downloaded from the internet. That label helps Office, SmartScreen, and other defenses treat an outside file with more caution. Attackers found a way around it. For most people, the correct response is pleasantly boring: install the security updates and restart.

Administrators of on-premises Exchange Server had a second job. Microsoft acknowledged that the same month’s Windows Server updates could leave Exchange databases offline, break Outlook on the web, and cause mail queues to grow. Microsoft published a temporary registry mitigation while it worked on a permanent resolution.

This is where patching advice needs a little adulthood. “Patch immediately” and “don’t interrupt a critical service” are both reasonable instructions, but they are not a plan. A plan defines the maintenance window, verifies backups, installs the update, checks Exchange services and databases, tests mail flow, watches queues, and records what changed. If something fails, the team uses the vendor’s current mitigation rather than randomly uninstalling every update that appeared nearby.

Reliable automation

Automation is wonderful until it quietly stops working three Tuesdays ago. Raymond Tec builds integrations with logging, monitoring, and failure handling in mind so the boring work stays automated without becoming mysterious.

Ordinary Windows users do not need to change Exchange registry settings. Small businesses using Microsoft 365 in the cloud are not running this on-premises Exchange role either. This affects organizations that operate their own Exchange servers or pay someone to do it. The broader lesson still applies to everybody: an update is complete when the system is both safer and working, not when the installer reaches 100 percent.

The supermarket attack crossed from data into food

A cyberattack on a French supermarket’s refrigeration controls reportedly caused food spoilage and raised fire-safety concerns. The important word here is controls. This wasn’t mainly about stealing a customer database. Network-connected controllers monitor temperatures, compressors, alarms, and other physical equipment. If remote access or outdated management software is compromised, the consequences leave the screen.

Connected equipment is attractive because it saves labor. One technician can monitor many locations, spot temperature drift, and adjust systems without driving across town. That also means the remote connection is a path into machinery that matters. The right response is not to rip out every network cable. It is to know what is connected, who can reach it, which software version it runs, and what employees can do locally when the remote system is unavailable or untrustworthy.

For a restaurant, pharmacy, grocery store, warehouse, or building manager, inventory the controllers that can affect temperature, doors, cameras, alarms, lighting, and power. Separate them from ordinary office devices where practical. Remove abandoned remote-access accounts. Confirm that alerts go somewhere a human will see them. And write down the manual fallback before an emergency, because “we will figure out how the refrigeration panel works while inventory is warming up” is not a continuity plan.

This week’s BeyondTrust and ConnectWise incidents fit here too. The common issue is delegated control. We give software authority because a person doing every task manually would be slow, expensive, and error-prone. Then we forget to examine what happens when that delegated authority is misused. Convenience is not the mistake. Unexamined concentration of control is.

Privacy promises need to match the actual control

Meta removed a broad clause from proposed commercial terms after website owners objected that it could permit the company to use content reachable through its business tools for artificial-intelligence development. The revision matters, but it also revealed a recurring confusion. A contract, a robots.txt instruction, and a server-side access block are three different things.

A contract says what a company has agreed it may do. Robots.txt asks compliant automated crawlers not to visit certain places. A login, firewall rule, or other access control can prevent an outside system from reaching content at all. None substitutes perfectly for the others. If material is public, assume people and machines can copy it. If material is confidential, do not rely on a crawler request to keep it confidential. And if a platform’s terms claim rights you cannot accept, the decision is contractual and operational, not a search-engine setting.

The same principle applies inside a company. Data brokers have reportedly offered businesses money for access to internal messages and documents used to train AI systems. Removing names may reduce some risk, but conversations can still reveal clients, strategy, health matters, legal advice, trade secrets, and enough detail to identify people. Before selling or sharing a dataset, ask who had authority to consent, which promises were made when the information was collected, and whether the data can be recalled once it enters a model-building pipeline. “Anonymized” is not a magic word, and “valuable for AI” is not a purpose.

Something Good: Perseverance drove past a record, carefully

NASA’s Perseverance rover has now driven farther on another world than any previous vehicle. On October 11, it reached 28.10 miles on Mars, narrowly passing Opportunity’s record of 28.06 miles. Opportunity took almost fifteen years to cover its distance. Perseverance did it in about five and a half.

The speed comes partly from AutoNav, an autonomous navigation system that builds a three-dimensional view of the terrain and chooses a route between waypoints selected by people on Earth. NASA says more than 90 percent of the rover’s distance has been driven using AutoNav. The earlier Sojourner rover could evaluate about twenty terrain points at a time. Perseverance can assess around 600,000.

Technology is rarely just about the technology

Some of the most important technology stories aren’t product launches at all. They’re about health, privacy, education, law, accessibility, work, and what happens when technology reaches ordinary people. Browse more Raymond Tec News for the stories worth understanding without the hype.

That is a useful picture of automation done well. Humans choose the destination and the scientific priorities. The machine handles thousands of small steering decisions because waiting for instructions across millions of miles would make every drive painfully slow. The rover still has constraints, monitoring, and a mission team. Autonomy isn’t the absence of control. It is control arranged at the right level.

What to watch next

The most immediate question is when ConnectWise can safely restore backup and recovery service, and what the investigation reveals about activity in customer tenants. Watch for a permanent Microsoft fix for the Exchange problem, and for evidence that criminals have begun exploiting BlockStrap now that technical details and patches are public. None of that calls for panic. It calls for specific checks, honest uncertainty, and recovery plans tested outside the sunny-day path. This week, the tools with the most authority created the biggest questions. Next week, what matters is whether vendors and customers can turn those questions into evidence.

Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.

When Security Tools Become the Attack Path