msp security2 articles
Stolen ConnectWise Credential Gives Attackers the Keys to 173 Microsoft 365 Tenants
Unknown threat actors have compromised a Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick), gaining unauthorized access to 173 customer and partner M365 tenants on October 15, 2026. Because the backup application holds broad permissions across mailboxes, OneDrive, SharePoint, and Teams, the attackers inherited extensive access to sensitive data in every affected tenant, with some activity also involving privilege escalation by adding Global Administrator rights and new credentials to other trusted applications. In response, ConnectWise has shut down Cloud Backup application access, while security firms and Microsoft are urging affected organizations to disable the app, audit service principal sign-in logs for the suspicious IP address (144.172.64.128), and review any credential changes made since October 13.
N-able's N-central Authentication Bypass Gets Patched Twice After First Fix Left Door Open
Attackers exploited an authentication bypass vulnerability (CVE-2026-18556/CVE-2026-18577) in N-able's N-central remote monitoring platform to gain administrative access to servers and then pivot to managed customer endpoints using the platform's Take Control feature. They also installed persistent Cloudflare tunnels on compromised devices, meaning that simply upgrading N-central is insufficient — customers must also actively hunt for and remove malicious tunnel services. N-able's initial patch proved incomplete, and the fully fixed version (build 2026.3.1.7) was released on August 2, with self-hosted customers required to upgrade manually.