Posts
OS Weekly: When Your Trusted Tools Become the Way In
This week’s lesson is uncomfortable: the tools you trust most are part of your attack surface. A backup service became a path into Microsoft 365 tenants, a remote support product joined the growing list of exploited edge bugs, and Microsoft shipped a patch load roughly ten times the usual size. Here’s what working and aspiring security pros need to know.
Critical Threats
ConnectWise Cloud Backup Incident Reaches Microsoft 365 Tenants
ConnectWise temporarily shut off customer access to its Cloud Backup service after a security incident in which hackers accessed application identities and used them to compromise Microsoft 365 tenants. As part of the investigation, the company disabled seven application identities, ConnectWise Cloud Backup among them. Who was behind it, and the full scope, haven’t been disclosed yet.
Why it matters: a backup integration needs broad, standing access to your tenant to do its job, which makes it a high-value target. This is a good week to list every third-party app with consented permissions in your Microsoft 365 tenant, check what each one can actually reach, and confirm you’d notice if one of them started behaving differently. If you’re early in your career, learning to audit app registrations and OAuth consent is one of the most useful cloud-security skills you can build right now.
Read more at The Hacker News → · BleepingComputer →
BeyondTrust Remote Support Zero-Day Extends the Run on Edge Bugs
Ivanti, Cisco, and Palo Alto Networks were already under scrutiny this week for vulnerabilities in their edge devices. Now a zero-day in BeyondTrust Remote Support has joined the list, continuing the trend of attackers going after the software that sits at the network perimeter.
Why it matters: remote support and edge products are built to be reachable from outside and to hold privileged access inside. That combination is exactly what attackers want. Know which of these products you run, keep them on a short patch cycle, and limit who and what can reach their management interfaces. For aspiring analysts, edge-device exploitation is one of the most consistent patterns in this field. Learning how these attacks show up in logs pays off quickly.
Vulnerabilities & Patches
Microsoft Patches More Than 1,400 Security Flaws
Microsoft released updates for more than 1,400 security vulnerabilities in Windows and other software. That beats September’s record of nearly 1,000 fixes and is roughly ten times a typical month. Cisco Talos’ Patch Tuesday breakdown covers critical updates across Windows, Office, and .NET Framework, mostly addressing remote code execution, privilege escalation, and information disclosure flaws, along with new Snort rules.
One related heads-up: Microsoft has acknowledged that recent Windows updates may stop non-admin users from connecting through Remote Desktop when the “Administrator protection” feature is enabled. Test before you push broadly.
Why it matters: at this volume you can’t treat every patch as equally urgent. You need a way to rank them by exposure and exploitation, plus a test ring that catches breakage like the Remote Desktop issue before it hits everyone.
Read more at Krebs on Security → · Talos Patch Tuesday breakdown → · Remote Desktop issue at BleepingComputer →
Tools I use: A quick aside from me, not part of the news. When patch month looks like this, the manual glue (pulling the advisory list, matching it to your asset inventory, opening tickets, pinging owners) eats the time you need for the actual prioritization. I use Make to wire those steps together visually instead of babysitting a pile of brittle scripts. (Affiliate link: it supports CyberShield at no cost to you.)
Vghost: A Decade-Old Linux Kernel Flaw Hands Local Users Root
A vulnerability in the Linux kernel’s vhost subsystem, present for almost a decade, lets local users read and write kernel memory and escalate to root. In certain virtualization setups it’s worse: an untrusted VM can alter host memory and hijack the VM program. The flaw, nicknamed Vghost and tracked as CVE-2026-74580, was discovered by Tencent Zhuque Lab, and The Hacker News reports it was found with AI.
Why it matters: if you run multi-tenant virtualization or host workloads you don’t fully trust, guest-to-host risk moves this up your list. Patch kernels on hypervisor hosts first. It’s also another example of AI-assisted research turning up bugs that sat unnoticed in mature code for years.
Read more at The Hacker News →
Tools & Strategy
Talos’ Q3 Vulnerability Pulse: Discovery Isn’t Exploitation
Cisco Talos’ latest Threat Source newsletter asks whether we’re really living through a “Bugmageddon.” It looks at Q3 trends in CVEs and the Known Exploited Vulnerabilities (KEV) list, and lands on a measured answer: vulnerabilities are increasing, but the number of bugs discovered isn’t the same as the number being exploited. Assess the real impact instead of reacting to the totals.
Why it matters: read this next to the 1,400-fix patch month above. Exploitation data like KEV is how you decide what gets fixed this week and what can wait for the normal cycle. Being able to explain that difference to leadership is a skill that sets analysts apart.
Tools I use: When I need to turn that kind of analysis into a one-page brief leadership will actually read, I build it in Canva with a few dark-mode templates I keep for threat briefs and patch summaries. (Affiliate link: it supports CyberShield at no cost to you.)
Industry News
Ransomware Pressure Moves Off the Keyboard
Dark Reading reports that ransomware gangs are embracing physical threats and stalking employees’ families. Organizations have reported employees facing threats of harm to their families, stalking, physical violence, and abduction, though verifying these claims has proven difficult.
Why it matters: extortion is no longer only about encrypted files and leaked data. Incident response plans should cover how employees report personal threats, who they go to, and when law enforcement gets involved. Security teams and HR need to work this out together before it’s needed.
Also This Week
- U.K. sanctions Cryptomus, a crypto platform alleged to facilitate ransomware, darknet, and fraud payments
- ANSSI-FR, France’s national cybersecurity agency, publishes its MLA project on GitHub
- Meta removes terms language that raised data-scraping and AI-training concerns, and says its crawling hasn’t changed
That’s the week. Audit the apps you’ve trusted with tenant access, patch the edge first, and use exploitation data to cut a 1,400-item patch list down to what matters now. We’ll see you next Sunday. Follow along for daily updates in between.