One ConnectWise credential reached 173 customer tenants

Four of today's security items share a shape. In each case the component that was compromised was not the target: it was the thing holding access to the targets.

ConnectWise had a single Microsoft 365 credential tied to its Cloud Backup product compromised, and Huntress says it confirmed unauthorised sign-ins across 173 partner and customer tenants using that one credential, per The Hacker News. The recommended response is the measure of the problem: disable the application until ConnectWise resets all credentials. There is no per-tenant remediation on offer, because the credential was never per-tenant.

Unit 42 reported the same arithmetic one layer down. Attackers tracked as CL-STA-0954 exploited CVE-2024-47575 on a centralised FortiManager appliance to steal configurations and credentials for more than 500 managed firewalls, then used a FortiOS path traversal flaw, CVE-2025-61624, to deploy PEERSTITCH (Unit 42). Read the two steps together. The first bought 500 firewalls' worth of credentials from one box. The second installed a memory-resident ARM64 implant that patches the miglogd and iked daemons, deletes its own binary, opens no listening ports and makes no outbound connections of its own, which is to say the payoff was paired with a foothold built to leave nothing to find.

The scanner is the way in

Cisco disclosed active exploitation of CVE-2026-76519, a file-write flaw rated 9.8 in Secure Email Gateway's Advanced Malware Protection feature that lets an unauthenticated attacker run commands as root by sending a crafted email, with no workaround available (The Hacker News). CISA added it to the Known Exploited Vulnerabilities catalog and set US federal agencies a patch deadline of October 17, which is today. The flaw sits in the component whose job is to inspect hostile mail, and the delivery mechanism is a message arriving at an appliance bought to read messages like it.

The newest entry on the list is an AI builder

Langflow's authenticated remote code execution flaw, CVE-2026-105740, drew 1,423 exploitation attempts against Previdian honeypot sensors since September 19, putting the low-code AI agent builder under sustained automated probing (The Hacker News). That figure is not a breach count, and the flaw needs authentication. What it measures is attention: a tool that builds and runs agents is now worth 1,423 automated attempts across four weeks, on one set of sensors.

What the four have in common

Not a vendor, not a protocol, and not a class of bug. The file-write, the path traversal, the stolen credential and the authenticated RCE have nothing technical in common. What they share is position. Each compromised component sat above the thing being defended:

• a vendor's cloud credential above 173 customer tenants
• one management appliance above more than 500 firewalls
• a malware scanner above the mail it was bought to read
• a builder above whatever agents it runs

Concentration is what the products are for. A backup vendor exists so that 173 tenants do not each run backups; FortiManager exists so that 500 firewalls are not configured 500 times. The economics of the attack follow the economics of the purchase, which is why the ConnectWise advice is to turn the product off rather than to clean each tenant, and why the Cisco bug carries a federal deadline measured in days rather than a workaround.

Three of the four are published dates between October 14 and today. None of them is a new idea about security. The arithmetic is just unusually legible in one day's record: one credential, 173 tenants; one appliance, 500 firewalls.