Briefing — 19 October 2026

🎧 Subscribe to the podcast feed

Security News

ConnectWise shuts down SaaS backup, security and management services to probe security incident (The Register) — ConnectWise has taken its SaaS-based RMM, backup, and security services offline; Huntress alleges active Microsoft 365 account takeovers connected to ConnectWise infrastructure, posing supply chain risk to MSP-managed clients globally.

Linux KVM guest-host escape rated critical — new attack surface for virtualised networking (The Register) — A critical KVM vulnerability may represent a new class of guest-to-host escape issue in how KVM handles network operations, affecting multi-tenant virtualisation environments.

Plex RCE vulnerabilities (CVE-2026-96652/96654/96655/96656) exploited in wild (Bored Hacker Blog) — Four chained CVEs in Plex Media Server ≤ v1.43.2 are being actively exploited to drop XMRig cryptominer and "myawesomeproxy" residential proxy tool linked to the Aisuru botnet. Patch to v1.43.3+ immediately.

Alleged sale of Fortinet access credentials across multiple countries (Threat Feed) — Threat actor forum post advertising unauthorised FortiGate access credentials for targets in multiple countries, consistent with ongoing FortiBleed exploitation campaigns.

Alleged OpenRouter breach — 250,000 API keys (Threat Feed) — A threat actor claims to hold 250,000 OpenRouter API keys from a breach of the AI model routing platform. OpenRouter has not confirmed the incident.

Storm Ransomware hits US maritime and logistics sector (Threat Feed) — New Storm Ransomware victims include Baltimore Tank Lines, Merit Financial Advisors, and Patriot Maritime — the maritime sector targeting continues a pattern of supply chain layer attacks.

n0n Ransomware adds Finzly (banking technology) (Threat Feed) — Finzly, a US banking infrastructure platform serving community banks and credit unions, has been added as a victim by the N0n ransomware group.

Alleged data breach of vFairs (Threat Feed) — The virtual events platform vFairs is alleged to have been breached with database contents appearing in underground forums.

Alleged data breach of Phonelyne.com (UK) (Threat Feed) — A UK-registered company, Phonelyne.com, has appeared in threat actor forums with alleged data breach claims — details unverified.

UK & Critical National Infrastructure

No new NCSC advisories have been published in the past 48 hours.

The ConnectWise incident is directly relevant to UK defenders. A significant number of UK SMEs and enterprises are protected by managed service providers running ConnectWise RMM and backup tooling. If ConnectWise's SaaS management layer has been compromised, every downstream MSP client is potentially within an attacker's lateral movement path. UK MSPs using ConnectWise should audit Microsoft 365 admin account activity and review for unauthorised access immediately.

Phonelyne.com — a UK company — has appeared in threat actor forums with an alleged data breach claim. Unverified at this stage but worth monitoring.

Infrastructure note: Microsoft has pulled out of a planned UK data centre project now delayed until the 2030s due to power grid capacity constraints. This reflects a structural challenge for UK cloud infrastructure resilience planning as AI-driven demand continues to strain the national grid.

Internationally, Qilin ransomware's targeting of Pengurusan Aset Air Berhad (Malaysia's national water asset management authority) is a reminder that CNI — particularly water utilities — remains an active ransomware target, with direct lessons for UK water sector defenders.

Ransomware Victims (48h)

~35 victims · 12+ groups

Today's Picks

• Plex vulnerabilities being exploited in the wild to drop a cryptominer — Excellent honeypot-based research with live traffic analysis, IOCs, file hashes, and PCAP samples for detection engineering. The residential proxy payload (myawesomeproxy) linked to Aisuru botnet is the more concerning long-term threat.