Latest Threat Intelligence — Week of October 19, 2026
Our security analysts track vendor advisories, CISA alerts, and live attack campaigns, then translate each one into what it means for a business that has to keep working. At the top of the feed right now: a stolen credential for the ConnectWise Cloud Backup app used to sign straight into 173 Microsoft 365 tenants with no password and no multifactor prompt; a China-linked spy group exploiting BeyondTrust Remote Support, the tool IT teams use to reach every other computer, for about seven weeks before anyone disclosed it; attackers taking over Cisco Secure Email Gateways with nothing more than a crafted attachment; and three chained Ivanti VPN flaws that Ivanti’s own integrity checker did not catch. Notice the pattern: every one of these is a tool you bought to protect or manage your business — the backup, the remote-support tool, the email filter, the VPN. Trusting a tool is not the same as watching it. What decides the cost of an incident is how fast someone notices the trusted tool doing something it shouldn’t, and what evidence you can hand the bank, the insurer and your customers afterward.