Cybersecurity Radar — 2026-10-19
Critical security operations are underway as ConnectWise suspends its Cloud Backup service following a breach of application identities, while a newly disclosed BeyondTrust zero-day (CVE-2026-102764) is being actively exploited in attacks since August. Additionally, threat actors are increasingly targeting physical building systems and supermarket refrigeration units, signaling a dangerous shift toward operational technology (OT) vulnerabilities.
Cybersecurity Radar — 2026-10-19
🔴 Critical Alerts
ConnectWise Cloud Backup Service Suspended Due to Identity Compromise IT management provider ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. The company took this action on October 17, 2026, at 07:00 UTC, revoking certificates used for affected application connections across all users to contain the breach.
BeyondTrust Remote Support Zero-Day (CVE-2026-102764) Actively Exploited BeyondTrust has disclosed CVE-2026-102764, a critical vulnerability in its Remote Support (RS) product that has been exploited as a zero-day since late August. The flaw allows attackers to bypass security controls, and while a patch is now available, organizations must immediately verify they have applied the fix to prevent ongoing exploitation.
Threat Landscape
Shift Toward Physical Infrastructure Attacks Cybercriminals are moving beyond data theft to attack physical building systems, including access controls and HVAC infrastructure. Recent reports highlight "unprecedented" attacks on supermarket refrigeration systems in France, demonstrating how digital breaches can have tangible, real-world consequences for food security and facility operations.
AI-Linked Ransomware and Psychological Extortion A new survey indicates that 84% of ransomware victims point to an AI link in the attacks, with cybercriminals increasingly weaponizing AI. Furthermore, 37% of ransomware attacks now involve psychological or physical threats, with attackers using phrases like "we know where you are" to pressure victims into payment.
Phishing Campaigns Targeting AI Assistants Threat actors are evolving their social engineering tactics by targeting AI assistants alongside human employees. A growing phishing scam uses calendar invitations ("You have a meeting") to bypass traditional email security filters, exploiting the trust users place in their scheduling tools and AI integration.
Vulnerabilities & Patches
Microsoft October Patch Tuesday: Record 1,413 CVEs Microsoft released its largest ever round of security updates in October 2026, addressing a record 1,413 vulnerabilities. This massive patch set includes fixes for multiple zero-days and critical flaws across Windows and other services, requiring extensive testing and deployment efforts for IT teams.
Windows Shell Zero-Day CVE-2026-96951 Among the October patches, CVE-2026-96951 is a critical security feature bypass flaw in Windows that has been exploited in the wild. CISA has ordered agencies to fix this vulnerability by October 16, 2026, marking it as a high-priority remediation for all enterprise environments.
Breaches & Incidents
ConnectWise Microsoft 365 Tenant Compromise As detailed in the Critical Alerts section, the compromise of ConnectWise's application identities led to a suspension of backup services. This incident highlights the risks associated with third-party IT management tools having broad access to Microsoft 365 environments, where a single identity breach can cascade across multiple customer tenants.
Industry & Policy
Record High Ransomware Attacks in 2026 New data reveals that ransomware attacks reached a record high in 2026, with 1,073 firms falling victim globally in August alone. The industrial sector remains the most affected, underscoring the urgent need for enhanced OT security measures and incident response planning.
What to Watch
- OT Security Vulnerabilities: Monitor for further attacks on physical infrastructure, such as building management systems and refrigeration units, as threat actors continue to bridge the gap between IT and OT.
- AI-Augmented Phishing: Keep an eye on phishing campaigns that specifically target AI assistant integrations and calendar applications, which are bypassing traditional email gateways.
- Ransomware Evolution: Watch for the continued rise of "data exfiltration only" attacks that skip encryption, breaking traditional recovery plans based on restores.
Reader Action Items
- Patch BeyondTrust RS Immediately: Verify that all instances of BeyondTrust Remote Support are updated to the latest version to mitigate CVE-2026-102764, which has been exploited for weeks.
- Audit Third-Party Identity Access: Review and revoke unnecessary application identity permissions for third-party IT management providers, particularly those with Microsoft 365 access, following the ConnectWise incident.
- Review OT Security Posture: Assess the security of physical building systems and operational technology, ensuring they are segmented from general IT networks and monitored for anomalous behavior.
This content was collected, curated, and summarized entirely by AI — including how and what to gather. It may contain inaccuracies. Crew does not guarantee the accuracy of any information presented here. Always verify facts on your own before acting on them. Crew assumes no legal liability for any consequences arising from reliance on this content.
Powered by
