ConnectWise Backup Hack Hits 162 M365 Tenants as Replit Picks OpenAI

AI & Machine Learning

Replit has made OpenAI the default model provider for Replit Agent, replacing Anthropic, although customers can still choose Claude. CEO Amjad Masad said the decision came down to “cost, partnership, and performance”, and at TechCrunch Disrupt he argued that OpenAI’s models now do better at building vibe-coded apps from scratch on Replit’s public benchmark. Until recently Replit was one of Anthropic’s top five customers, and it was promoting Anthropic products only weeks ago. Anonymous insiders disputed that the partnership has ended entirely. The switch shows how quickly the large AI coding platforms will change model suppliers as pricing and benchmark results move. Source: TechCrunch Verified: True

Palo Alto startup Elorian has released its first model, Glimpse, as a research preview with API access and a chat interface. While it reasons, Glimpse can crop into parts of an image, pull out individual video frames and run code to measure or compare what it sees, which the company calls a “visual scratch space”. Elorian is led by former Google DeepMind researcher Andrew Dai and raised a $55 million seed round at a $300 million valuation, co-led by Striker Venture Partners, Menlo Ventures and Altimeter, with Nvidia and Jeff Dean also investing. On its own evaluations, Glimpse beats GPT-6 Astra on scientific chart reasoning and short-form video captioning. It costs $0.60 per million input tokens and $3 per million output tokens. Source: TechCrunch Verified: True

Vercel’s October 2026 production index says open-weight models handled 71.5% of tokens on its AI Gateway. Their share of spending rose from about one dollar in twenty in June to nearly one in four in September, while the average price per token fell about 47%. Anthropic’s Claude Opus 5.5 still had the largest share of September spending at 11.03%, followed by OpenAI’s GPT-6 Astra at 4.86% and DeepSeek V4.1 Flash at 4.19%. Chinese models took large shares of tokens but smaller shares of spending: DeepSeek carried 58% of tokens for just 6.6% of spend. The figures cover only traffic routed through Vercel’s gateway, but they point to cheaper open models taking over high-volume work. Source: The Register Verified: True

Consumer Hardware

Google is rolling out new AI-powered protections on Android against scam messages, fake bank calls and call-forwarding abuse. The main new feature in Google Messages uses cloud-based Gemini to analyse conversations with unknown senders inside its encrypted Private AI Compute environment, but it is off by default and users have to opt in. On the device, Gemini Nano checks unfamiliar links against real-time web signals and shows clearer warnings before opening links from unsaved numbers. Android now also stops apps from silently turning on call forwarding, and Google’s verified bank calls system, which ends calls that cannot be confirmed as coming from a bank’s call centre, is expanding to more institutions. Sensitive-information masking during screen sharing now covers Chrome and Android WebView. Source: BleepingComputer Verified: True

Waymo is expanding into Toronto after it was approved to join Ontario’s automated vehicle pilot program, its first step into Canada. It won’t offer rides straight away: it will first drive cars manually to build high-definition maps of the city’s streets, then test autonomously with a human safety operator before eventually removing the operator and opening the service to the public. No dates have been given for those stages. Waymo has partnered with Toronto-based Element Fleet Management to support hundreds of jobs in fleet maintenance, validation driving, customer service and operations. The company already runs robotaxi services in 15 US cities and is testing in London and Tokyo. Source: TechCrunch Verified: True

Cybersecurity

ConnectWise has cut off customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after attackers abused the service’s application identities to break into Microsoft 365 tenants. Huntress has confirmed at least 162 compromised tenants in its environment and saw suspicious directory role assignments in nearly 50 tenants it monitors, and Todyl has reviewed nine intrusions. The activity began on October 15 from a single IP address, after scripted sign-in attempts on October 13 and 14. Because the attacker signed in as the backup application, multi-factor authentication did not stop it, and in one tenant the intruder gave itself Global Administrator rights. Microsoft Threat Intelligence calls it an active supply-chain attack. ConnectWise says it has seen no sign that partner backup data was taken and has not said when the service will return. Source: BleepingComputer Verified: True

Burger King Japan has disclosed a breach that exposed 11.18 million customer records tied to its official smartphone app. The data includes names, dates of birth, gender, email addresses, phone numbers and order history, but the company says no card numbers were stored on the affected server and it found no evidence that login credentials were accessed. Investigators found that the unauthorised access to the app’s member-data system took place between October 2 and October 7. How the attackers got in is still being investigated with outside security experts. The company has blocked the source of the access, reported the incident to Japan’s Personal Information Protection Commission and warned customers to watch for impersonation scams. Source: BleepingComputer Verified: True

The recent hack of remote-controlled refrigeration at hundreds of French grocery stores, which spoiled food and started fires, is part of a broader move by attackers from stealing data to disrupting physical building systems. Other examples include an August ransomware attack that disabled door access, HVAC monitoring and staff badges at a Canadian hospital. Armis Labs found that 73% of organisations own building automation systems of a type already hit in ransomware attacks, and that 91% of those systems use insecure protocols. Dragos counted 1,020 ransomware incidents against industrial organisations in the first quarter of 2026 and 1,140 in the second, and estimates that fewer than 10% of operational technology (OT) networks are adequately monitored. One Semperis responder described a victim that refused to pay and was locked out of its own offices until police broke the windows. Source: The Register Verified: True

Enterprise Infrastructure

Workday is pitching its AI agents as something customers can pay for out of their staffing and outsourcing budgets, not just their IT spend. Charges for the agents will rise with usage rather than with the number of licensed users, which co-founder and CEO Aneel Bhusri called “a far better model” than per-seat subscriptions. New this week are broader “headless” access to Workday’s HR and finance systems through Model Context Protocol (MCP) tools and Workday Data Cloud, which shares data with Snowflake, Databricks and Salesforce. Chief AI Officer Joel Hellermark said automation could take the market “beyond the software budgets into the labor and services spend”. Reuters separately reported that Silver Lake was in talks to buy Workday. Source: The Register Verified: True

Windows Server 2022 reached the end of mainstream support on October 13, making the October 2026 security update its last mainstream release. The operating system is now in extended support, which provides free security updates until October 14, 2031, and hotpatching for Datacenter: Azure Edition continues until October 2027. Microsoft is telling administrators to plan their move to Windows Server 2025, which has mainstream support until November 2029 and extended support until November 2034. The change means no further feature or non-security fixes for one of the most widely deployed server releases. A free 180-day evaluation of Windows Server 2025 is available for testing migrations. Source: BleepingComputer Verified: True

A Japanese consortium of shipping firm NYK Line, NTT Facilities, renewable developer Eurus Energy and MUFG Bank plans to build floating datacentres on barges moored alongside port quays. The idea is to use existing port infrastructure and nearby power generation instead of waiting for scarce land and grid connections. A renewable-powered demonstration at the port of Yokohama has been running since March 2026, but the group has not announced capacity figures or a date for commercial operation. NYK Line is leading development. The project is one of several unconventional approaches operators are trying as AI demand pushes up against power and siting limits. Source: The Register Verified: True

Policy & Regulation

Meta has removed a clause from its commercial terms of use, days after it drew criticism, that said the company could “use any content” from a business account’s domains, web pages or URLs to develop and train its products. Legal experts quoted by Nieman Lab had called it a “remarkable provision” that could let Meta scrape publishers’ websites to train AI models. Meta says it “heard” the criticism, and that the terms only ever applied to its ads and business products and never changed how it crawls the web. The Verge reported that the language has now been taken out. The quick reversal shows how closely publishers and regulators are now watching AI-training clauses in platform contracts. Source: TechCrunch Verified: True

UK officials have not committed to adding AI-specific measures to the Cyber Security and Resilience (Network and Information Systems) Bill, telling MPs that amendments on AI risks are still under consideration. Senior civil servant Alexandra Jones said the government is “looking at” such changes, and AI minister Kanishka Narayan promised it “will legislate wherever necessary”, but the bill’s text has not been changed. Committee chair Liam Byrne pushed back, saying “you have to legislate for something in a bill”, and concluded that AI companies cannot be trusted to regulate themselves. The hearing also heard from AI Futures Project director Daniel Kokotajlo. For now, AI and loss-of-control risks remain outside the UK’s main cyber resilience law. Source: The Register Verified: True

X has removed more than 13,000 accounts it ties to three suspected foreign influence operations aimed at US political debate, weeks before the November 3 midterm elections. The company attributed the networks to Iran, Russia and China and said they used fake accounts to post and amplify content about candidates and public figures across the political spectrum. X has not published evidence for those attributions. The platform relies on its crowdsourced Community Notes feature to add context to election posts, a system European regulators have scrutinised, and it has cut moderation staff since Elon Musk’s takeover. The purge adds to pressure on platforms over how they police election interference. Source: The Register Verified: True