One Stolen Password Unlocked 173 Companies — Plus 1,411 Windows Patches
Saturday, October 17, 2026 · 5-minute read
The UK government has sanctioned Cryptomus — a cryptocurrency payment platform also known as Heleket — for helping Russia dodge financial restrictions and processing payments tied to ransomware, drug markets, and human trafficking. Blockchain analytics firm Chainalysis says Cryptomus and Heleket received more dirty money than any mixer in their dataset. The sanctions freeze UK-held assets and ban British firms from doing any business with the platform.
↗ Krebs on SecurityFBI agents arrested a Canadian cybersecurity executive in Pennsylvania this week, suspecting him of ties to ShinyHunters — the same hacking group that recently stole sensitive data on thousands of FBI agents. The suspect was attending a cyber insurance conference in Philadelphia at the time of his arrest. Court records show charges of cyber extortion and conspiracy, though the core complaint has been sealed.
↗ Krebs on SecurityBurger King Japan disclosed a major data breach after attackers got into a server holding records on 11.18 million customers. The fast-food chain's Japanese arm is now notifying affected users. If you've ever ordered through Burger King Japan's app or website, your personal information may be in the wrong hands.
↗ BleepingComputerAttackers got hold of a single credential belonging to ConnectWise Cloud Backup, a tool that managed service providers use to back up Microsoft 365 data. Because that one account was trusted by every customer who had the app installed, the attackers used it to sign into 173 separate organizations' Microsoft 365 environments — accessing mailboxes, files on OneDrive, SharePoint, Teams, and more. Security firm Huntress confirmed the unauthorized sign-ins and warns the stolen credential still works. This is a textbook example of how supply chain attacks can hit hundreds of victims through a single weak link.
Between May and July 2026, attackers repeatedly tampered with the update servers for AOMEI Backupper, a popular Windows backup program. In short windows of five to ten minutes at a time, any computer that checked for an update downloaded a hidden backdoor instead of a legitimate update. Google's Threat Intelligence Group and Mandiant confirmed the campaign. AOMEI says it has fixed its servers — but that fix does nothing for machines that already got infected during those windows.
A maximum-severity flaw in Magento and Adobe Commerce — software that powers thousands of online stores — could let an attacker run any code they want on the store's server. That means they could steal customer payment details, install malware, or take the whole site offline. Researchers warn active exploitation could start very soon.
Status: Patch available — online store owners should update immediately and contact their hosting provider if unsure.
Attackers are actively exploiting a critical flaw in the Collabora Online document editor built into Nextcloud, a self-hosted file storage platform used by businesses and schools. The bug lets attackers run commands on the server — meaning they could access all files stored there. Active exploitation has already been confirmed in the wild.
Status: Patch available — Nextcloud administrators should update the Collabora/richdocumentscode app without delay.
Microsoft's giant October Patch Tuesday — covering a record 1,411 flaws — included one zero-day: a security bypass in the Windows Shell affecting Windows 10, 11, and some Server versions. Attackers are already using it in the wild. Windows 10 users who worried about losing security updates can breathe a little easier — Microsoft quietly extended free support for Windows 10 to October 2027.
Status: Patch available — run Windows Update today if you haven't already this month.
Google has started rolling out new AI-powered protections for Android that detect scam text messages and suspicious call-forwarding attempts in real time — before you even respond. The feature analyzes message patterns on your device without sending content to Google's servers. It's designed to catch the kind of convincing fake bank texts and phone scams that often slip past traditional filters. The rollout is gradual, so not every Android user will see it immediately — check your Messages and Phone app settings for a "Scam Detection" option.
Security researchers confirmed that Candiru spyware was planted on devices at Al Jazeera Media Network simply by displaying malicious online ads — a technique called a zero-click attack. The victim's device didn't need to tap anything. This shows that even careful, security-aware users can be compromised through the normal web browsing experience. Using an ad blocker reduces your exposure to this kind of attack significantly.
Imagine a property management company that holds master keys for 173 apartment buildings. If someone steals that company's master key, they don't just get into one apartment — they get into all of them. That's almost exactly what happened this week with ConnectWise Cloud Backup and hundreds of its customers' Microsoft 365 accounts.
ConnectWise Cloud Backup is a service sold to managed service providers — IT companies that look after technology for dozens of small businesses each. To do its job (backing up emails, files, and Teams messages), the app is granted very broad access to its customers' Microsoft 365 environments. All of that access flows through one shared credential. Somehow, attackers got hold of that credential. Security firm Huntress confirmed that the attackers then used it to sign into 173 separate organizations' Microsoft 365 accounts. Every mailbox, every OneDrive file, every SharePoint site — potentially exposed.
For everyday workers at those 173 companies, this could mean that emails, internal documents, HR records, or financial data were accessed by strangers. The organizations likely had no idea anything was wrong — there were no broken passwords on their end, no suspicious logins from their own accounts. The breach came entirely through a trusted third-party tool they'd installed and forgotten about. That's what makes supply chain attacks so dangerous: the victim did nothing wrong.
This incident is a sharp reminder that the security of your data isn't just about your own passwords and devices — it also depends on every app and vendor you've ever given access to. If you're a business owner or manager, now is a good time to audit which third-party apps have access to your Microsoft 365 or Google Workspace account. Remove anything you no longer use. And if you work with an IT provider, ask them which tools have admin-level access to your systems — and what would happen if one of those tools was compromised.