A Blank Password Field and a Relay Trap: What the ScreenConnect SCKit Attack Actually Teaches

On November 11, 2026, at 17:47 UTC, someone started pushing commands through cloud-hosted ScreenConnect panels belonging to managed service providers. Within 90 minutes, at least 288 endpoints across