# IT Daily Roundup: October 18, 2026 > Oct 18, 2026 · #security #microsoft #cloud #fortinet #atlassian A ConnectWise Cloud Backup breach hit 173 Microsoft 365 tenants without triggering MFA, FortiOS malware PEERSTITCH hid entirely in daemon memory for months, and Atlassian Data Center CVE-2026-21589 has reached its CISA patching deadline today. ## 1. ConnectWise Cloud Backup breach reached 173 Microsoft 365 tenants ConnectWise Cloud Backup (formerly SkyKick) had its application credentials stolen. Starting October 15, the attacker used them to sign into Microsoft 365 and accessed at least 173 customer tenants. Because the sign-in came from an app rather than a user, MFA was never triggered. In several tenants, the ConnectWise application assigned itself the Exchange Administrator role; in one case it went further and grabbed Global Administrator. Huntress counted 173 confirmed unauthorized sign-ins within its own monitored environment. The total number of affected tenants is not yet known. ConnectWise suspended Cloud Backup access while investigating. Resetting the application's credentials alone is not enough: tokens already issued to the attacker remain valid for up to 90 minutes after the block. Check the service principal sign-ins tab in Entra ID, filtered by application ID 506e08f9-6e9a-4da4-942b-a099a03644ae, and look for IP address 144.172.64.128. Also audit whether any application added new secrets or directory roles since October 13. > **Why this matters:** Most MSP and IT outsourcing teams have backup and monitoring applications consented in client tenants with very broad permissions. If those application credentials get out, the customer's MFA setup offers no protection. Auditing exactly what each consented app can read and write is worth the time. ## 2. PEERSTITCH: FortiOS daemon memory malware, patch available since April Unit 42 (Palo Alto Networks) published an analysis of intrusion campaign CL-STA-0954. Threat actors tracked as UNC5820 exploited path traversal vulnerability CVE-2025-61624 in the FortiOS command-line interpreter (patched April 2026, advisory FG-IR-26-122) to deploy malware called PEERSTITCH. It is written in C, runs entirely in memory, and writes nothing to disk. Using ptrace, it injected hooks into two running daemons: miglogd and iked. The iked hook marks a VPN session with a hidden flag, and tagged sessions then bypass FortiOS security checks. The resulting covert access leaves no trace in logs. Initial access in this campaign came through a separate flaw in FortiManager (CVE-2024-47575, also known as FortiJump). From there, the attackers pulled configurations and credentials for more than 500 FortiGate devices. Because PEERSTITCH leaves no file on disk, standard antivirus and file-integrity monitoring will not detect it. Indicators of compromise include connections to 23.240.77.233 on port 8085, the files lldprx, index.wasm, and ipssem.js, and unexpected ptrace activity against miglogd or iked. > **Why this matters:** The patch has been available since April 2026, yet this malware moved unnoticed through some networks for months. If you manage FortiGate devices for customers, verify that FG-IR-26-122 has been applied and review FortiManager configuration backups from the past six months for signs of unauthorized access. ## 3. Atlassian Data Center CVE-2026-21589 is actively exploited CVE-2026-21589 is an unauthenticated arbitrary file read vulnerability rated CVSS 9.3. It affects Data Center editions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. An attacker can read any file within the web application root directory without logging in, provided they know the exact path. For Crowd and Jira, that includes crowd.properties, which holds credentials that can lead to full administrative access. Security firm watchTowr published the vulnerability details, and Previdian observed exploitation attempts from three IP addresses within two hours. CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog on October 15, setting a federal patching deadline of October 18. Atlassian Cloud instances were patched automatically. Self-hosted Data Center installations require manual updates; for example, Jira Software targets are versions 9.12.40 and 10.3.26. > **Why this matters:** Configuration files in Jira and Confluence hold database passwords and API tokens. Any self-hosted Data Center installation of these products should be checked for the current version and patched today. --- © 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-10-18-it-daily-roundup.html