Blackpoint Cyber

UPDATE 03: November 13th, 2026, 1423 ET Renewed ScreenConnect campaign activity, appearing to target on-prem instances. Keep the 5 flagged extensions disabled (RMM+ now has a Critical CVE, CVE-2026-127063), upgrade to 26.6.5+, and check technician clients. Read the full technical research: blackpointcyber.com/blog/scr… #MSP #screenConnect #cybersecurity

What makes a great cybersecurity partner? It's more than just the technology or a 24/7 human SOC. 🤝 It's about finding a partner who understands your business, works alongside your team, and adapts to the way you operate and your budget. For MSPs, no two businesses are exactly alike. Different systems, processes, client demands, and ways of doing things mean a one-size-fits-all cybersecurity approach just doesn't cut it. That's why we love hearing positive feedback like this from our partners. For Netfriends, working with Blackpoint means: 🟢 A tailored approach: Solutions, licensing, playbooks, and procedures that align with their unique needs. 🟢 A collaborative partnership: Technical and account management teams who know the business and actively work with them. 🟢 Confidence in the value: Enabling them to clearly communicate cybersecurity value to customers. 🟢 Seamless integration: Deep expertise, a powerful platform, and API capabilities that fit into existing systems and workflows. As John Snyder puts it, they don't feel like just another client number. They feel known, supported, and understood. That's what a true cybersecurity partnership should look like. 🎥 Hear directly from John about what makes the Blackpoint partnership different. #MSP #Cybersecurity #MSPCommunity #CybersecurityPartnership #Blackpoint

What would a Friday be without a blog post that shares how an OAuth attack unfolds? The scary part about an OAuth attack? The user can do everything right, including entering their password and approving MFA, and still hand an attacker the keys. And a password reset won't necessarily kick them out. OAuth attacks exploit trusted applications and legitimate permissions to gain access to Microsoft 365 environments, often flying under the radar of traditional security tools. Blackpoint's ITDR, backed by our 24/7 SOC, detects suspicious identity behavior and helps contain threats within seconds, before an attacker has time to move deeper into the environment. Because seeing the login isn't enough. You need to see what happens after. See exactly how an OAuth attack unfolds, and how to stop it. Read the breakdown: bit.ly/4BNVKKa #Cybersecurity #MSP #ITDR #Microsoft365 #IdentitySecurity

🔐 Password reset ≠ threat contained. On Oct. 27, see a live OAuth attack simulation and learn how attackers retain Microsoft 365 access, plus how CompassOne detects and contains the threat. 🕐 1 PM ET | 45 min Register: blackpointcyber.com/webinar/… #MSP #ITDR

UPDATE 2: PHP patches are out. Update to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 now. PHP confirms unauthenticated RCE for CVE-2026-109618 and CVE-2026-109619 and says there are no complete mitigations. 8.1 and older get no official packages. Exploit code is public, early attacks reported. Live SitRep, updated in place: blackpointcyber.com/blog/php… #PHP #CVE2026109618 #php2shell

PHP Critical Security Update - Two (RCE) vulnerabilities 🚨 Security Advisory: Critical PHP Remote Code Execution Vulnerabilities 🚨 The PHP development team has announced emergency security updates addressing two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. The updates are scheduled for release tomorrow, October 21, 2026, at 14:00 UTC (10:00 AM ET), following reports that information about the vulnerabilities was leaked ahead of their planned disclosure. While full technical details and affected versions have not yet been officially disclosed, organizations operating PHP based applications and services are strongly encouraged to prepare for these updates and prioritize patching as soon as fixes become available. The Blackpoint Adversary Pursuit Group (APG) is actively monitoring developments and conducting further research into these vulnerabilities. We will share additional findings and guidance as more information becomes available. Recommended actions Identify PHP installations: Review your infrastructure and customer environments for PHP-based applications, including WordPress, Magento, and custom web applications. Prioritize internet-facing systems: Identify publicly accessible PHP applications and prepare them for emergency updates. Coordinate with hosting providers: Confirm who is responsible for deploying PHP security patches and establish an update plan. Prepare to patch immediately: Apply the appropriate vendor security updates once available, and validate application functionality afterward. Review exposure: Consider restricting unnecessary external access to vulnerable systems where immediate patching may not be possible. Important: Updating application plugins or themes alone does not replace the need to patch the underlying PHP runtime. How Blackpoint is Protecting Partners Our Adversary Pursuit Group (APG) has proactively reviewed available security telemetry for suspicious activity potentially associated with these vulnerabilities. We are continuing to evaluate emerging intelligence and opportunities to strengthen coverage for our Partners as technical details become available. Our Blackpoint Response Operations Center (BROC) continues to monitor supported environments around the clock, investigating suspicious activity and responding to identified threats. Existing Blackpoint detections are designed to identify suspicious activity associated with exploitation and post-exploitation. These detections provide an additional layer of visibility into malicious behavior across supported and monitored environments. For the latest official information, visit the PHP Security Announcement. php.net/archive/2026.php#202… Blackpoint Cyber Adversary Pursuit Group (APG)

Some threats don’t stay dead. Others just come back wearing a different costume. This October, Inside the SOC Episode 8 is getting a Cybersecurity Awareness Month takeover with Spooky Stories from the SOC. Join Blackpoint’s SOC and threat research teams as we open the case files on: ChainScript: A Node.js RAT using a Polygon smart contract based C2 resolver to keep its infrastructure flexible. RemotePanel + BoundSiphon: A combination of persistent remote access and rapid credential, browser data, and cryptocurrency theft. Cybersecurity Awareness Month: Practical lessons MSPs can use to strengthen their own defenses and help protect their customers. Same threats. Different costumes. New ways to get caught. Tuesday, October 6 | 10:00 AM MT Register here: blackpointcyber.com/webinar/… No demo. No sales pitch. Just real threat research and practical insights from the SOC. #Cybersecurity #ThreatIntelligence #MSP #CybersecurityAwarenessMonth #ThreatResearch See less

For the #msp and #cybersecurity communities. Sharing a critical threat notice. ⚠️ CRITICAL Threat Notice: Citrix NetScaler ADC and NetScaler Gateway ⚠️ support.citrix.com/support-h…

Kimsuky, the North Korean threat group, is stealing credentials via QR codes in its latest round of attacks, @SCMagazine reports. 🔎 hubs.ly/Q03__ryT0 | #Cybersecurity #Quishing

MSPs, are you still paying the SIEM tax? 💰 The truth: Compliance doesn't need to be complex... or expensive. Get the full breakdown: hubs.ly/Q03_WQZf0 | #Cybersecurity #MSP

ClickFix. Rogue RMM. VPN siege. 🔍 The threats of 2025 were defined by deception. The defense of 2026 needs to be defined by verification. hubs.ly/Q03_JMRg0 | #Cybersecurity #MSP #ThreatIntel

APT28 is targeting NATO-aligned energy and defense groups, @SCMagazine reports. 👇 hubs.ly/Q03_ttH90 | #ThreatIntel #MSP

We're proud to see @BlackpointUS CEO Gagan Singh recognized by @CRN as one of the 10 Biggest IT CEO Moves of 2025. 🗞️ hubs.ly/Q03_7fYc0 | #Cybersecurity #MSP

What a week at #CES2026! 🙌 'Good enough' won't stop the next global outage, as @BlackpointUS' Manoj Srivastava explained during his @CES panel. hubs.ly/Q03-YFwq0 | #Cybersecurity #MSP

Juggling siloed tools and drowning in alerts? Trust us — you need to watch this. 👀 hubs.ly/Q03-Bck30 | #Cybersecurity @CIOonline

How do you get the majority of your clients to adopt MDR in just 60 days? 👇 hubs.ly/Q03-n2080 | #Cybersecurity #MSP

Over 5,000 vulnerabilities were disclosed last month — with more than 2,300 rated high or critical. 🚨 hubs.ly/Q03-gLm_0 | #Cybersecurity #ThreatIntel

Cyber insurance carriers have raised the bar — and alerts alone won't cut it anymore. 👇 hubs.ly/Q03ZMhNs0 | #Cybersecurity #MSP

Start your engines, MSPs! 🏁 We'll see you in a few weeks at #RightOfBoom2026 in Las Vegas, and @BlackpointUS is bringing the ultimate giveaway for anyone who loves speed. We're giving away a VIP weekend to the 2026 #Indy500! hubs.ly/Q03ZKSyl0 | #Cybersecurity #MSP