Update fast, trust slowly: what October’s poisoned updates teach operators

Seven days, seven trusted channels

Between 15 and 21 October, seven separate incidents followed the same script. None of them is known to be linked to the others. In six of them, an attacker used something the victims had already chosen to trust. The seventh, at a certificate authority, had no known attacker but showed how fragile that trust is.

1. 15 October · Backup vendorA Microsoft 365 app credential belonging to ConnectWise Cloud Backup (formerly SkyKick) was used to sign in to customer tenants. In one, the vendor's app added itself to the Global Administrator role and planted new credentials on other apps. Huntress confirmed unauthorised sign-ins in 173 tenants (Huntress, Daily Security Review).
2. 15–16 October · Plugin vendorRank Math PRO 3.0.123, downloaded from the vendor's own website, carried a backdoor that recreated itself when removed. It was available for about 11 hours (BleepingComputer).
3. 17–18 October · Site management dashboardAttackers took UpdraftCentral connection keys from TeamUpdraft's customer database, then used them to create administrator accounts and install at least 99 malicious plugins. Around 400,000 sites were potentially exposed (BleepingComputer).
4. 17–20 October · Certificate authorityThe private keys of eight eMudhra intermediate certificates turned out to be computable from the public certificates, a flaw dating to a 2025 key ceremony. Chrome, Firefox, Apple, Microsoft and Android blocked them within three days (The Hacker News).
5. 19 October · Developer toolA hijacked developer account replaced five OVHcloud CLI releases on GitHub with secret-stealing builds. They were live for 94 minutes (BleepingComputer).
6. 21 October · Open-source AI gatewayStolen maintainer tokens were used to publish a credential-stealing LiteLLM 1.107.0 to PyPI and Docker registries. It was live for about two hours (LiteLLM).
7. 21 October · Cloud platformRailway disclosed unauthorised access to the systems that store customer environment variables, some of them decrypted. It paused deployments and told customers to rotate their secrets (Railway).

The windows were short. The reach was not.

The common thread: borrowed trust

None of these attacks needed a flaw in the victims' own systems. The attacker compromised one supplier and inherited the trust its customers had already granted.

Four conditions repeat across the week.

• Standing privilege. The ConnectWise app held rights in customer Microsoft 365 tenants around the clock, not only while a backup ran. An UpdraftCentral key can install plugins on any site it connects to.
• Secrets that outlive their purpose. The LiteLLM attack began with a master key committed to a public repository on 27 May and never revoked; it still worked on 10 October. The OVHcloud developer account had reportedly been compromised for more than six months.
• Release controls that can be switched off. Release immutability was disabled on the OVHcloud repository, so a privileged account could replace published files without passing CI checks. At LiteLLM, an organisation owner's token overrode branch protection.
• Secrets as the prize. Almost every payload hunted for the same things: cloud credentials, API keys, database passwords, environment variables. Railway believes its incident was part of a series of attacks on platform companies aimed at reaching AI inference providers.

Your attack surface is no longer only what you run. It is the sum of everyone you have let in.

The patching paradox

The same month asked defenders to install more updates, faster, than ever before.

Microsoft's October Patch Tuesday set a record (Infosecurity Magazine); other outlets counted 1,413 to 1,415 fixes. Infosecurity links the surge to Microsoft's use of AI to find flaws, and in July Microsoft had warned customers to expect a flood of patches.

Eight days later, PHP shipped fixes for two critical flaws, dubbed PHP2Shell, that affect nearly every version back to PHP 5.4. Wiz, which found them with AI-assisted research, showed unauthenticated remote code execution on default WordPress, Drupal and Joomla images (Wiz). Governments in the UK, Finland and Japan took some services offline as a precaution (AP via News4JAX).

So defenders must update faster through the very channels that were poisoned that week. Slowing down is not the answer: our earlier article, Off the map, showed that attackers already move faster than maintenance windows. The answer is to verify what arrives and to limit what any single update, vendor or key can reach.

Why this reaches beyond websites

Most of October's victims ran websites and cloud software. The same trust model runs through industrial and critical operations, often with fewer controls.

• Vendor remote access. Integrators and equipment makers keep remote-access paths into plants and remote sites for maintenance. Like the ConnectWise app, that access is often permanent rather than granted per job.
• Management platforms. One platform that manages hundreds of sites, controllers or devices is the industrial version of an UpdraftCentral key: compromise the platform, reach every site.
• Firmware and software updates. Operators install vendor updates on assets they cannot easily rebuild. A poisoned update to a controller is harder to detect and slower to undo than a bad web plugin.
• Device certificates. Connected devices prove who they are with certificates. eMudhra showed that a weakness at a certificate authority can force an emergency replacement of trust, and Mozilla warned that removing the affected root will break some legitimate certificates too. Devices in the field are far harder to re-key than browsers.

The interest is strategic, not only criminal. Alongside the ConnectWise activity, Huntress tracked a separate targeted wave against 16 organisations, mainly in policy, national security, trade and critical minerals (Huntress).

Six moves for this quarter

1. 01List everyone with standing access. Vendor apps in your cloud tenants, managed service tools, remote-access agents, management dashboards. For each one, write down what it can do on a bad day, not on a normal one.
2. 02Replace standing access with access on request. Vendor sessions should be brokered, tied to a named person, time-limited and logged, and opened through a channel you control rather than a permanent inbound path.
3. 03Treat secrets as perishable. Short-lived tokens, scheduled rotation, automatic revocation when a key appears in a repository or a log. Assume anything stored in a platform's environment variables can one day be read.
4. 04Verify before you install. Pin versions, check signatures and hashes, and roll routine updates through a canary group first. Most of October's poisoned releases were live for hours, so a short soak would have caught them. Keep a separate fast lane for flaws that are actively exploited.
5. 05Watch for what follows a poisoned update. New administrator accounts, apps granting themselves roles, new credentials added to other apps, outbound connections to unknown domains. These were the signs in nearly every October case.
6. 06Know your trust anchors. Inventory the certificate authorities your systems and devices trust, and rehearse replacing one within days. October showed that a root can be withdrawn in less than a week.