Managing Many Customers’ Backups Is Becoming a Product
Patch N-central before you read the rest. The pre-authentication flaw N-able fixed on 5 September is being exploited, and it sits in the platform you use to reach every endpoint you manage.
Then the week’s actual theme, which is not about protecting data better. Scality has shipped fleet management for backup-as-a-service providers. LucidLink has launched an MSP programme. Synology has widened the platforms its appliances protect. All three are about running a service across a hundred customers rather than five, which has been the awkward gap for years. Vendors sell software that protects one estate well, then leave the multi-tenant arithmetic and the upgrade cycles to you.
Quiet week for European news beyond the Cyber Resilience Act, so this issue leans global. No M&A either: deals closed, but none with backup or DR material to the business changing hands.
Vendor releases
Scality ships fleet management for backup providers
Scality Maestro 1.1 became generally available on 10 September. It manages fleets of ARTESCA object storage deployments from one console: health monitoring, automated software and firmware upgrades, and centralised capacity tracking that feeds billing.
The connection model is the part worth noting. There is no VPN into the customer site. Each deployment opens an outbound connection to Maestro and reports in. An early user described the old way as separate logins, VPN tunnels and capacity reports assembled by hand. The dashboard shown manages 114 deployments and 12.15PiB. On-premises only for now, SaaS planned, no pricing published.
The practical bit. Protecting one customer well has been solved for a decade. Running the same service across a hundred without a spreadsheet is what limits how many you can take on. Ask how you upgrade a fleet, and where the invoicing numbers come from.
Source: StorageReview
Synology widens what ActiveProtect will protect
ActiveProtect Manager 2.0 is available now, at no extra cost for every DP Series appliance, announced 10 September. It adds Amazon EC2, Azure VM, Proxmox VE, Nutanix AHV and Google Workspace, plus cross-platform recovery and volume-level encryption. Azure Blob joins the tiering destinations. Synology says 2.1 will add anomaly detection and malware scanning before a restore, with no date.
The practical bit. Proxmox VE and Nutanix AHV are the two that matter, because that is where clients leaving vSphere are landing. Covering both plus the hypervisor they came from removes a reason to run two backup products through a migration.
Source: StorageNewsletter
Rubrik backs up Iceberg tables inside the customer’s own account
Rubrik has announced Apache Iceberg Protection, covering Iceberg tables in AWS Glue Data Catalog and Amazon S3 Tables. It backs up the table data and the metadata that defines it, then re-registers the table in the catalogue on recovery so it comes back queryable in Athena. Immutable backups sit in the customer’s own AWS account. Rubrik calls it the industry’s first Iceberg-aware offering, which is its own claim. Generally available later this month, so not yet.
The practical bit. The useful line is that native snapshots are metadata pointers, not backups. Delete or corrupt the table and the pointers go with it. If a client has a lakehouse near production, somebody has probably assumed that away.
Source: iTWire
As a service
LucidLink launches an MSP programme
Announced ahead of IBC 2026, which runs 11 to 14 September. LucidLink streams files from existing storage such as Amazon S3 without migrating or staging copies. The programme lets providers deploy and manage those workflows across multiple customers from its management platform, aimed at media and post-production, live sports, and architecture and engineering. Bring-your-own-storage, and partners keep the customer relationship and the billing. No margins or tiers published.
The practical bit. Bring-your-own-storage means this sits on capacity you may already resell. Check “partners keep the billing” in the contract rather than the press release. That is the difference between a channel programme and a referral scheme.
Source: Channel Insider
Backblaze mounts B2 as a working drive
Announced 10 September and available now. Backblaze and Suite Studios have integrated S3 native file streaming, so a B2 bucket mounts through Suite Studios and behaves like a high-performance NAS. Streaming pulls only the parts of a file that are needed rather than the whole object, with no conversion or separate storage environment, and Suite files map one to one onto B2 objects. Media production is the documented workflow; Backblaze calls other sectors emerging rather than packaged.
The practical bit. Capacity you may already resell becomes a working tier rather than an archive. Note the sector caveat before quoting it outside media.
Source: Backblaze
What is being exploited
N-central is being exploited, and HF3 is not enough
N-able has patched CVE-2026-86218, a static code injection flaw in N-central allowing pre-authentication remote code execution. It scores CVSS 10.0. The fix shipped in 2026.3 Hotfix 4 on 5 September, bringing the build to 2026.3.1.14. CISA added it to the Known Exploited Vulnerabilities catalog with a federal deadline of 11 September, and N-able says it has observed a handful of successful exploits against N-central customers. watchTowr reproduced the attack.
Hosted instances were patched server side and need nothing. On-premises instances need HF4 applied by hand, and HF3 is not enough: the zero day is unrelated to the two flaws HF3 fixed, so a box on HF3 is still exposed.
The practical bit. Check the version, then check the logs. Those are two separate jobs and only one is quick. N-able has published indicators of compromise, and if the box was reachable and unpatched between 5 and 11 September you have some looking to do before you call it closed.
Source: The Hacker News · N-able
Regulation and compliance
The EU’s 24-hour reporting clock is running
Article 14 of the Cyber Resilience Act became applicable on 11 September 2026. Manufacturers selling products with digital elements into the EU, wherever based, must file an early warning within 24 hours of finding an actively exploited vulnerability, a detailed notification within 72 hours, and a final report within 14 days of a fix. Reports go through ENISA’s Single Reporting Platform. The maximum fine is €15m or 2.5% of turnover, whichever is larger. The rest of the CRA lands on 11 December 2027.
The practical bit. Check the scope before you quote for it. Most MSPs are not manufacturers, so the obligation sits with your vendors. If you ship an appliance, a white-labelled tool or your own software into the EU, find out now. Otherwise expect noisier vendor disclosure from here.
Source: The Register
Veeam says EMEA has a shadow AI problem
Veeam published research on 9 September reporting that 70% of EMEA organisations admitted automated AI workflows are touching sensitive corporate data without full oversight, and 67% said employees are creating workflows IT cannot track. Germany was highest at 81% and 79%, the UK reported 75%. Treat the numbers with care: this is vendor-commissioned research and neither the sample size nor the methodology was disclosed.
The practical bit. The direction is more useful than the percentages. Unapproved AI tooling creates data you are contracted to protect in places nobody told you about. That is a backup scoping problem before it is a governance one.
Source: Intelligent CIO Europe
Also worth knowing
- Veeam has extended its Palo Alto Cortex XSOAR integration, so a SOC can scan protected data and publish a backup disk for forensics without restoring it into production. Cortex Marketplace, for Data Platform Advanced and Premium. (Veeam)
- Commvault announced Active Directory Pre Recover, a clean standby copy of AD in an isolated environment. Early access is only promised “in the coming months”. (Blocks and Files)
- Conti developer Oleksii Lytvynenko was sentenced to four years in a US prison. Conti is estimated to have taken at least $150m from victims in over 30 countries. (SecurityWeek)
- Backblaze and WEKA have validated B2 as the object tier under NeuralMesh, with snap-to-object checkpoints landing in B2. (StorageReview)
- Backblaze has released an MCP server for B2, so an agent can query and manage buckets directly. (Backblaze)
- UK distributor Purdicom reported sales up over 18% to £45.4m for the year ended 31 December, operating profit up 12.4% to £1.9m. (IT Europa)
What to do this week
- Get N-central onto 2026.3 HF4. On-premises only, hosted is done. HF3 does not cover it. If the box was reachable and unpatched between 5 and 11 September, pull the indicators of compromise and go looking.
- Ask your object storage vendor how you upgrade a fleet. Not one deployment, the whole estate, and where the invoicing figures come from. If the answer involves VPN tunnels and a spreadsheet, that is your ceiling on customers.
- Find out whether any client has a lakehouse in production. Native Iceberg snapshots are metadata pointers, not backups, and somebody has probably assumed otherwise.
- Confirm whether the CRA applies to you at all. If you ship an appliance or your own software into the EU, find out now.
Backuptron’s weekly brief on backup and disaster recovery delivered as a service, read from Europe.
