The Circuitry
THE CIRCUITRYYour one-stop source for all tech news
HOMETODAYNEWSFEEDEVENTS
BOOKMARKS
RSS
© 2026 The Circuitry
About UsSourcesContactCorrectionsPrivacy
  • Today
  • Feed
  • Events
  • Saved
  • AAPL
  • MSFT
  • GOOGL
  • META
  • NVDA
  • TSLA
  • AMZN
  • INTC
  • SONY
  • TTWO
  • COIN
  • BTC
  • ETH
  • SOL
  • AAPL
  • MSFT
  • GOOGL
  • META
  • NVDA
  • TSLA
  • AMZN
  • INTC
  • SONY
  • TTWO
  • COIN
  • BTC
  • ETH
  • SOL

Feed

Ad
From The CircuitryVerified tech news, cross-checked.How we verify →
  • Court authority covers $1.2 billion stolen from BinanceTech
  • Operation TorNado brings 354 arrests and a $234 million seizureTech
  • Apple patches nine flaws in HomeView Software 27.2Tech
  • Microsoft lists 1,094 flaws in the November security updatesSecurity
  • Critical heap overflow flaw hits D-Link DIR-878 routerSecurity
  • Ninth Circuit rejects SpaceX bid to arbitrate worker caseTech
  • Amazon will cover remaining costs at eight Virginia collegesTech
  • SpaceX plans more than $74 billion for two supercomputing campusesTech
  • Cerebras reports $210.8 million in third-quarter revenueTech
  • Orchestrator pairs Carbon and Hydrogen in AntigravityTech
Scroll for more
Verification
VERIFIEDConfidence: HIGH
Source identified
Claims cross-referenced
No discrepancies found
Sourcing
1source

via ConnectWise

Ad
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →
Home/Tech/ConnectWise disables extensions in about 400 ScreenConnect environments
VERIFIEDBy Xavier Rivera·Thursday, November 12, 2026 at 12:34 PM AST·1.5 min read

ConnectWise disables extensions in about 400 ScreenConnect environments

ConnectWise says it is investigating unauthorized access to some partner ScreenConnect environments. It has found no evidence of a compromise of its own infrastructure or a flaw in ScreenConnect, and it disabled five third-party extensions in about 400 environments.

Source:ConnectWise
Post
ConnectWise disables extensions in about 400 ScreenConnect environments
Ad
From The CircuitryVerified tech news, cross-checked.How we verify →
Ad
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →
TL;DRAI · 60 sec read

ConnectWise says it is investigating unauthorized access to some partner ScreenConnect environments. A November 12 update says it has found no evidence of a compromise of its infrastructure or a flaw in ScreenConnect. About 400 partner environments had an RMM+ family extension. ConnectWise disabled five of those extensions where it could. On-premises partners have to disable them themselves.

ConnectWise is investigating unauthorized access to some partner ScreenConnect environments. The latest Trust Center update is timed 02:45 UTC on November 12, which is 10:45 p.m. AST on November 11. The status line is investigation ongoing. At this time, we have found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself.


At this time, we have found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself.
The working assessment is abuse of add-ons, not a flaw in the product. ConnectWise says the activity may involve a threat actor using independent third-party extensions that partners installed. The initial access method and the full scope are still under investigation. The first advisory went up at 22:45 UTC on November 11.


From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →
About 400 partner environments had at least one extension from the RMM+ family. Their presence alone does not establish compromise. Those extensions can run remote commands through an API. Access to that API is protected by a passphrase the partner sets during setup. ConnectWise disabled five extensions where it could act: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. On-premises partners have to disable them themselves. ConnectWise cannot do that for them.


Their presence alone does not establish compromise.
Disabling the extensions is containment, not a cleanup. ConnectWise says it cannot see what happened inside a partner environment after the first access. Partners have to check their own logs, revoke sessions, reset credentials, and turn on multifactor authentication. Disabling the extensions and resetting credentials may not remove software or access already on an endpoint. The advisory tells partners not to re-enable or reinstall the five extensions until there is further guidance.


Ad
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →
The advisory also lists reported indicators. They include two IP addresses, several domains, and file names tied to a reported loader. ConnectWise says those indicators do not establish how access started, and that a clean search does not rule out a compromise. It will post further updates in the Trust Center.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Morning Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning.

Two minutes, free forever. What's in The Brief →

Reader-supported
DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →
HELP US IMPROVE
From The Circuitry

See what’s happening right now

The Feed runs all day — short, verified briefs the moment they break.

Open the Feed →
From The Circuitry

Follow @thecircuitry_

Every story we publish, as it happens. No noise between.

Follow on X ↗On Bluesky ↗

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee
securityconnectwise
More inTech
  • Ninth Circuit rejects SpaceX bid to arbitrate worker case

    Tech · 2h
  • Amazon will cover remaining costs at eight Virginia colleges

    Tech · 2h
  • SpaceX plans more than $74 billion for two supercomputing campuses

    Tech · 2h
SupportThe Work

The Circuitry is reader-supported. If you find the daily brief useful, you can buy me a coffee to keep it going.

Buy a coffee →
Ad
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →

MORE IN THIS BEAT

All Tech →
  • Tech·Nov 12

    Court authority covers $1.2 billion stolen from Binance

    The Justice Department has court authority to seize or restrain more than $1.2 billion in cryptocurrency stolen from Binance. A wider freeze of more than $2.7 billion includes private-sector holds, and tracing is still underway.

  • Tech·Nov 12

    Operation TorNado brings 354 arrests and a $234 million seizure

    The Justice Department has announced 354 arrests and the seizure of more than $234 million in cash and virtual currencies from Operation TorNado. The sweep ran from May 2025 to October 2026 and did not split that money between cash and crypto.

  • Tech·Nov 12

    Apple patches nine flaws in HomeView Software 27.2

    Apple released HomeView Software 27.2 on November 12 with fixes for nine security issues. One could let a remote attacker join an iMessage group and receive its messages. Another could let a Bluetooth device pair without a person's approval.

  • Tech·Nov 10

    Microsoft lists 1,094 flaws in the November security updates

    Microsoft's November 2026 Security Updates list 1,094 flaws, including 63 rated critical and one Outlook bug already exploited.

  • Tech·Nov 9

    Critical heap overflow flaw hits D-Link DIR-878 router

    A critical heap-based buffer overflow affects the D-Link DIR-878 on firmware 1.20B05 through the HNAP Handler. The flaw allows remote unauthenticated attacks and has a public exploit available.