Tech News Briefing — Sunday, October 18, 2026

The stories IT students and working techs are talking about today — a supply-chain breach that keeps widening into customer Microsoft 365 tenants, a coding agent whose users' AI API keys may be in the wild, an email gateway compromised by the attachments it was supposed to scan, a hardware-wallet heist pulled off by a hidden circuit board, and a national ID register opened with the world's worst password. Each story includes why it matters for your certification studies. Every claim in this briefing was fact-checked before publication.

1. ConnectWise disables seven app identities as its Microsoft 365 breach widens

ConnectWise disabled seven of its application identities at 07:00 UTC on October 17 and suspended its Cloud Backup service (formerly SkyKick), after attackers used compromised vendor credentials to sign into customer Microsoft 365 tenants. The identities ConnectWise lists as disabled cover Cloud Backup, Cloud Management, MS Teams, Exchange Online, MS Graph, and Partner Center. Security firm Huntress says confirmed unauthorized sign-ins grew from 162 tenants on October 16 to sign-in activity in nearly 1,000 tenants from the single IP 144.172.64.128, with more than 300 successful — and a second, targeted wave on October 15 hit 16 tenants in policy, national-security, trade, and critical-mineral sectors. The sobering detail: tokens issued before the identities were disabled can stay valid until they expire, so tenants must audit service-principal sign-ins and rotate app secrets themselves. ConnectWise says there is still no evidence stored backup archives were accessed.

Source: The Hacker News · ConnectWise Trust Center update, Huntress analysis, October 18, 2026

2. OpenCode breach exposes developers' AI API keys

OpenCode, the terminal-based AI coding agent built by Anomaly Innovations, disclosed that unauthorized access to a legacy system it was decommissioning may have exposed third-party provider keys — OpenAI, Anthropic, Google — saved in some Console workspaces. The company calls it a "large scale distillation attack" affecting roughly 1.4% of Console users, the subset that had linked external providers, and says it emailed everyone affected. Several users reported unauthorized charges on their provider accounts before the notification went out. Anthropic is reported to have revoked the affected Claude keys. Anyone who got the email is told to revoke and reissue each key at the provider's own dashboard, update every app that used the old key, and check billing back to October 17.

Source: Cyera analysis · The Latent, October 17–18, 2026

3. Cisco's email gateway gets owned by an attachment nobody opened

Cisco warns attackers are actively exploiting CVE-2026-76519, a critical path-traversal flaw (CVSS 9.8) in the Advanced Malware Protection file-reputation feature of Secure Email Gateway. The kicker: nobody needs to open the attachment — the gateway compromises itself while inspecting the file. A remote, unauthenticated attacker who can send mail through the appliance can write arbitrary files and execute commands with root privileges, but only where File Reputation is enabled and Content Scanner Tools is older than 25.3.0.5525. Cisco says this is the second actively exploited SEG flaw in a month (after CVE-2026-76461); CISA added it to its Known Exploited Vulnerabilities catalog on October 14 with an October 17 federal patch deadline. The fix is a scanner-tools update to 25.3.0.5525 or later (no restart needed) or fixed AsyncOS releases 15.5.5-014 / 16.5.0-780.

Source: SecurityWeek · Cisco PSIRT advisory · CISA KEV catalog, October 14, 2026

4. A spy chip inside a hardware wallet: the $93M Ledger supply-chain heist

Ledger confirmed on October 10 that at least one hardware wallet contained an unauthorized hardware implant — a small circuit board with a microcontroller, antenna, LTE chip, and e-SIM hidden behind the screen. It watches the screen for the 24-word recovery phrase during setup and transmits it over cellular networks; with the phrase, an attacker can rebuild the wallet anywhere and drain it. On-chain analysts traced about $93.2 million drained from 315 wallets across six blockchains starting October 9, and Tether froze roughly $10 million in USDT. All confirmed cases trace to devices sold through CryptoBilis, a reseller in Indonesia, Malaysia, and the Philippines — Ledger says its own systems and direct sales were not compromised. The nasty detail: the devices arrived shrink-wrapped and passed Ledger's Genuine Check, because the security chip inside was real.

Source: Help Net Security · Ledger statements, Bitquery on-chain analysis, October 10–13, 2026

5. '123456' and 8.8 million Danes: the year's most embarrassing password story

Denmark confirmed on October 5 that its Central Person Register — the national database of personal ID numbers — was abused through the legitimate access of Pays ApS, a two-employee IT firm in Odense. Names, addresses, and CPR numbers of about 8.8 million people were pulled (the register holds roughly 11 million records, including the deceased and emigrated). The person claiming responsibility told Danish newspaper Politiken that at least three Pays accounts, including the administrator account, used the password "123456" — attributed to the claimant, not independently forensically confirmed. Documents obtained by broadcaster TV 2 show about 14 million automated searches ran between September 10 and 20, and nobody noticed until October 2, when a ministry staffer spotted an unusually large invoice. Denmark's Agency for Public Security now says a CPR number alone can no longer be trusted to verify someone's identity.

Source: Information & Data Manager · Politiken, TV 2, Danish ministry statements, October 16, 2026