Sovereign Cloud Now Has a Budget Line
European cloud sovereignty stopped being a panel topic this week and became a purchase order. The European Commission has named the four providers its institutions can buy from under a six-year framework worth EUR 180m, and Keepit passed $100m in annual recurring revenue selling much the same argument to private buyers.
On the product side, MSP360 has made Proxmox backup free for a single host, which matters more than it sounds if your clients are leaving vSphere. Bacula shipped 18.2.5, Druva added ransomware detection, and Veeam and NetApp put out a REST-based ONTAP plug-in.
Patch Acronis Backup for cPanel and Plesk if you run either. The plugin is being exploited and CISA’s deadline for federal agencies was 19 September. No regulation section this week, because nothing happened that was not already on last week’s clock.
Vendor releases
MSP360 makes Proxmox backup free for one host
MSP360 Backup Community Edition for Proxmox went live on 15 September. It is free with no trial and no subscription, and it backs up Proxmox VE at the hypervisor level, capturing full VM disk images including attached virtual disks. Full, incremental and forever-forward-incremental backups, with GFS retention.
The limits are one Proxmox host of up to two CPU sockets, and 5TB of backup storage. Proxmox VE only: VMware and Hyper-V are excluded, and the Community Edition replaces rather than sits alongside the other standalone builds. Anything beyond that means MSP360 Backup VM Edition.
The practical bit. Proxmox is where a lot of clients leaving vSphere have landed, and the awkward part of that migration is usually that your backup licence does not follow them. A free single-host tier is enough to cover a pilot or a small client properly rather than improvising. Read the two-socket limit before you promise anything.
Source: MSP360
Bacula ships Enterprise 18.2.5
Released 14 September and available now through the customer portal. A new MongoDB plugin, snapshot plugin support for GPFS and ZFS with Lustre updates, DB2 support on AIX, and performance work in the BWeb management suite. The OpenStack, Libvirt, Xen, Microsoft 365 and HDFS plugins were all updated. Bacula describes it as an important bug-fix release, without listing the fixes in the announcement.
The practical bit. The interesting line is the workload spread. MongoDB, GPFS, Lustre and DB2 on AIX are not what most backup vendors court, and if you carry a client with a genuinely awkward estate this is the sort of catalogue that wins the deal.
Source: Bacula Systems
Druva adds ransomware detection to its backup snapshots
Druva has added ransomware detection that analyses backup snapshots for ransomware behaviour, using structural verification, entropy analysis, MIME type analysis and file integrity checks to confirm activity and cut false positives. A separate identity resilience capability reconstructs identity attacks through Dru MetaGraph. Ransomware detection is in limited availability now; identity resilience is generally available in October.
The practical bit. The claim worth testing at reference-call stage is the false positive rate. A detector that flags every large encrypted archive as ransomware costs you more hours than it saves. Ask what the confirmed-to-flagged ratio looks like in production, not in the datasheet.
Source: Channel Insider
Veeam and NetApp ship a REST-based ONTAP plug-in
The NetApp USAPI 2.1 Plug-in for Veeam Data Platform gives centralised ONTAP snapshot management from Veeam, SnapMirror replication and DR workflows launched from the same console, and support for tamperproof immutable ONTAP snapshots. It covers AFF, ASA, ASA.R2 and FAS systems, plus vSphere and MetroCluster or SVM-DR deployments. Veeam gave no general availability date in the announcement.
The practical bit. If you run ONTAP under Veeam you have probably been driving snapshots from two places for years. Worth asking your Veeam contact when this is actually shippable, because the post does not say.
Source: Veeam
CTERA puts an AI agent in front of its archive tier
Announced 16 September. InsightAI infers what a file is from its metadata, meaning name, path, extension and directory context, then scores it against age, type, size and usage to recommend what can be archived. CTERA Archive moves those files to an isolated, lower-cost tier that stays readable by analytics without a rehydration step. CTERA did not say when it ships.
The practical bit. Archiving cold data shrinks the backup window and the bill, which is the real appeal. The thing to check is what the agent does with a file it guesses wrong about, and whether a wrong guess is reversible without a restore.
Source: Blocks and Files
As a service
The European Commission names its four cloud providers
Cycloid, a French developer-portal company, has been chosen to build the developer-facing portal for the Commission’s sovereign cloud framework. The framework itself was announced in April: six years, EUR 180m, and it decides which providers EU institutions, bodies and agencies can buy cloud from.
The four are Post Telecom, with CleverCloud and OVHcloud as partners; STACKIT; Scaleway; and Proximus, with S3NS, Clarence and Mistral. Up to 5,000 developers will reach all of them through the one portal rather than contracting with each separately. Cycloid’s chief executive Benjamin Brial said a sovereign cloud framework is only as sovereign as the choices it leaves open.
The practical bit. This is the sovereignty argument with a budget attached, and it is the reference your public-sector clients will start quoting. Two of those four, OVHcloud and Scaleway, are already plausible backup targets. If you have been treating residency as a box on a questionnaire, it is now a procurement shortlist you can point at.
Source: IT Europa
Keepit passes $100m ARR
The Danish SaaS backup company announced on 17 September that it has gone past $100m in annual recurring revenue, alongside a strategy it calls AI Truth Cloud. Keepit says it has grown more than thirteenfold since One Peak invested in September 2020, a compound rate above 55%, and that it runs data centres across seven regions with 700 staff. Those growth figures are the company’s own.
Its pitch is vendor-neutral infrastructure: your Microsoft 365 or Entra backup does not sit inside Microsoft, so you keep access to the data even if you lose access to the SaaS provider holding the original.
The practical bit. A European SaaS backup business at that scale is now a credible answer when a client asks who else does this besides the American vendors. The independence argument is also the one that survives a procurement questionnaire, which is where most of these conversations are actually decided.
Source: StorageNewsletter
What is being exploited
An Acronis backup plugin for cPanel is being exploited
CVE-2026-87886 is a local privilege escalation flaw in the Acronis Backup plugin for cPanel and WHM on Linux, caused by insecure file permissions and rated CVSS 7.8. A low-privileged attacker can escalate and potentially run arbitrary code. Acronis says exploitation has been detected in limited, targeted attacks.
Affected are the cPanel and WHM plugin before build 1.9.3.1021 and the Acronis Backup extension for Plesk before 1.8.11.638. The fixes are 1.9.3 HF3 and 1.8.11.638 respectively. CISA required federal agencies to patch by 19 September, which has passed.
The practical bit. This is the backup agent on a shared hosting box, which is exactly the class of machine that gets patched late because nobody wants to touch a working cPanel server. If you run hosting alongside managed services, that is the estate to go through today, and low-privileged escalation means a compromised customer account is enough of a starting point.
Source: The Hacker News
Also worth knowing
- CTERA scanned 16PB across 856 enterprise file-share scans and found 4.4% of capacity actively used, with 88% of files untouched for over a year. Vendor-commissioned, but it publishes its method, which is more than most. (Blocks and Files)
- CISA added two Linux kernel flaws to the KEV catalog, CVE-2025-39964 and CVE-2026-53266. Neither is backup-specific, but both are on hosts you back up. (CISA)
- Arctic Wolf launched Aurora MDR Connect, an MDR tier aimed at MSPs serving midmarket and sub-100-seat clients, with the MSP as the direct customer. No pricing published. (MSSP Alert)
What to do this week
- Patch Acronis Backup for cPanel and Plesk. Build 1.9.3 HF3 and 1.8.11.638. It is exploited, CISA’s federal deadline was 19 September, and shared hosting boxes are the ones that get skipped.
- Check whether any client on Proxmox is running without a backup licence. MSP360’s free tier covers one host up to two sockets and 5TB, which is enough to stop improvising.
- Add OVHcloud and Scaleway to your residency answer. Both are now on the Commission’s framework, which is a better reference than a datasheet when a public-sector client asks where their data sits.
Backuptron’s weekly brief on backup and disaster recovery delivered as a service, read from Europe.
