CRN

In this edition, we take a look at what you need to know about the China state-aligned group that Microsoft said used agentic AI to launch 2,900 sign-in attempts per minute on Microsoft tenants in the ConnectWise Cloud Backup breach. Plus: - Five key things to know about two critical vulnerabilities in PHP that are facing active exploitation attempts - The industry's most visionary channel partners recognized in our inaugural AI Innovators list - Our 2026 AI Innovators Week news and analysis, and more

The threat of attackers potentially exploiting a pair of critical-severity PHP vulnerabilities could persist for some time, even though the initial evidence of exploitation of the PHP2Shell flaws appears to be modest, according to Justin Timothy, threat intelligence consultant at GuidePoint Security. Kyle Alspach has the details:

Time's running out! ⌛ Applications for our 2027 Channel Chiefs list are due tomorrow, Friday, Oct. 23! Apply here: https://lnkd.in/eCEU5qCa. We are still accepting applications for the 2027 edition of the annual CRN Channel Chiefs list, which will be published in February. Channel chiefs, this is your chance to be recognized for your commitment to your channel partners, and if you are selected for the comprehensive Channel Chiefs list, you will also be eligible for consideration for our 2027 Most Influential Channel Chiefs list. Deadline to apply for the 2027 CRN Channel Chiefs list ⏰: Tomorrow, Friday, Oct. 23, by 11:59 PM PST

Microsoft said the China state-aligned group Storm-0940 used agentic AI to launch 2,900 sign-in attempts per minute on Microsoft tenants in the ConnectWise Cloud Backup breach. Microsoft said the ConnectWise attack shows how threat actors are scaling their operations “exponentially” by “integrating agentic AI” into their attacks. Here are more details Microsoft shared in a security research blog on the “AI-Driven Large-Scale Nation State” attack, plus insights and perspective from Dustin Bolander, a managed service provider (MSP) and serial entrepreneur who is a partner and CEO of CyberDrain, a Microsoft 365 management platform, Huntress Principal Security Operations Analyst Jonathan Semon and ConnectWise Chief Technology Officer David Raissipour:

Ignacio Guillen is OpenAI’s new partner director in charge of go-to-market. OpenAI’s hiring of the former Amazon Web Services (AWS) partner sales leader is yet another example of the top channel partner executive talent its been continuing to hire from cloud leaders like Google Cloud and AWS. Here are more details on Guillen and his new role with OpenAI:

Congratulations again to the winners of our second annual Best of the Channel Awards! 🏆 🎉 Some of the channel’s best and brightest stars gathered at an awards gala at The Fox Theatre in Atlanta, Ga., last week to celebrate the winners. Here are snapshots from the night, featuring the following channel executives and awards judges, with details from Jennifer Follett: - Jon LoBello, director of IT channel program strategy for North America, Schneider Electric - Mike Csoke, senior account executive, ePlus inc. - Best Solution Provider Channel Visionary Award winner: Jim Keller, global head of Amazon Web Services (AWS) and Snowflake partnerships, Best Solution Provider Award winner: Quantiphi - Jhon Alexander, global marketing leader, Quantiphi - Steven Burke, executive editor, News, CRN - Tim Barton-Wines, CCO, Best Vendor Award winner: Halo - Chesley Choudhury, founder and chairman, TanChes Global Management, Inc. - ★TANAZ★ CHOUDHURY, president, TanChes Global ConRes’ Team: - Fredrick Sponholz, senior cloud services manager - Aaron Schnarrs, solutions manager, modern work - Shawn Timmerman, account executive - Paul Rossi, senior client account executive at Ingram Micro - Ashton Lande, director of cloud services and customer success - Mark Boisvert, director of marketing - Peter Mirabile, chief service officer, managed services - Liz Costerisan, chief revenue officer - Aaron Leiberman, chief technology officer - Nick Novello, account executive - Jennifer Roy, CEO, Nucleus Networks - Hank Dallam, CEO, NetGain Technologies, LLC - Best Channel Achiever Award winner: Brook Lee, senior director of community and channel, Rev.io - Stephanie Durden, MBA, channel marketing manager, Eaton - Anthony J. D'Ambrosi, CEO, Abacus - Pamela Diaz, managing director of global marketing, Abacus - Best Vendor/Distributor Channel Visionary Award winner: Gordon Lord, vice president of channel sales, Schneider Electric More executives, awards winners and judges in the comments! ↓

The arrival of ultra-powerful frontier AI models has rapidly dismantled practically all core assumptions of cybersecurity over the last year—requiring an equally massive shift in cyber defenses that can keep pace with the potential for autonomous cyberattacks and out-of-control agents, SentinelOne co-founder and CEO Tomer Weingarten said Wednesday. https://lnkd.in/eScWiHXk

There was standing room only for a Sunday talk by 5K Technical Services CEO Corey Kirkendoll, MBA, CISSP, CCSA, CHP, CCIE about why and how MSPs should take a proactive, "no-blame" approach to wrangling "shadow AI" within their customers. Shadow AI, if you haven't heard, means any kind of AI application that hasn't been approved by an IT department or MSP and could create a myriad of security risks. It was clear from talking to multiple MSPs or hearing them in sessions at The Channel Company's XChange NexGen event that shadow AI is a huge issue with customers. What I liked about Corey's presentation is how he took a practical view (customers are going to use AI whether or not you approve tools for them) and got fairly in-depth about what MSPs can do to create responsible AI use strategies for clients. My CRN article on Corey's talk hits on some of the most important points of creating those strategies, so I hope you give it a read, whether to jog your mind from when you attended the session on Sunday or if you're looking for ideas: https://lnkd.in/gCZigE4r

Two critical vulnerabilities in PHP are facing active exploitation attempts, creating an urgent need for widespread patching, according to cybersecurity researchers from Wiz, watchTowr, Huntress, CrowdStrike, and SentinelOne. The vulnerabilities, together known as “PHP2Shell” and considered a “critical” risk with severity ratings of 9.2 out of 10.0, can enable attackers to execute code remotely without authentication. PHP is a key technology behind numerous web platforms including WordPress and Drupal. CRN cybersecurity reporter and Senior Editor Kyle Alspach breaks down five key things to know about the “critical” PHP vulnerabilities and exploitation activity: John Hammond Amit S.

ConnectWise is aiming for the end of this week to get access back for its thousands of managed service providers (MSPs) to ConnectWise Cloud BackUp for Microsoft 365 and other services impacted by a security breach, ConnectWise Chief Technology Officer David Raissipour said. As for the potential data exfiltration impact on MSP Microsoft 365 tenants, Raissipour said ConnectWise is continuing a full-court press offensive to work with its MSPs to see if there was any “access to data” from Microsoft 365 tenants. Here are more details from Raissipour, Huntress Principal Security Operations Analyst Jonathan Semon and Keith J. Nelson, Ph.D., CEO of ConnectWise customer and MSP Vistem Solutions, Inc.: