Picture an admin opening the Microsoft Entra sign-in logs on a Friday evening and finding a sign-in from an app the company approved long ago. There is no user, no device and no MFA prompt. The source is a hosting provider address, not Microsoft's network. Nobody in the tenant clicked anything, and nobody in the tenant held the credential that signed in. ConnectWise says it identified unauthorized access to application identities associated with its Cloud Backup environment,

Picture an MSP technician checking the backup server on a Thursday morning because the fans are loud. Task Manager opens, CPU looks normal, and the window closes. An hour later the box is pinned again. The process doing the work is called edge.exe, it lives in a Temp folder, and the service that keeps it alive is called MicrosoftEdgeUpdateSvc. Nobody on the team installed Edge on that server. On 8 October 2026, Huntress reported threat actors chaining two AhsayCBS flaws, CVE-

You have seen this ticket. Print is still working. Someone applied the first emergency PaperCut patch when it dropped, the queue came back, and they closed it. The Application Server web UI is still on the internet because print admins do not like taking that box down twice in one week. That is the hunt. Not the CVE number. The hunt is the emergency patch that did not stay a patch. CISA put CVE-2026-81578 and CVE-2026-82078 on KEV on 31 August 2026. If you only ran Patch 1, y