A backup service breach reached Microsoft 365 accounts
If an IT company looks after your email, files and backups, read this item first.
In a post on October 21, 2026, Microsoft said a China-aligned group it calls Storm-0940 was behind the ConnectWise breach. Microsoft says the group used an open-source tool called ARTEX to try to sign in to more than 2,250 Microsoft customer accounts, which Microsoft calls tenants. In several of those attacks, Microsoft says, the time from first targeting to admin-level access was under three hours.
Under three hours means an attack can go from first target to admin access inside one afternoon. Nobody at a small shop watches sign-ins that closely, so the question belongs with whoever runs your IT.
ConnectWise paused access to its cloud backup service while it investigates. If your provider uses that service, ask whether your backups can be restored while the pause lasts, and how they would get your files back today if a laptop died.
None of this says your own account was reached. A sign-in attempt is a knock on the door, not a break-in. Only your IT provider can tell you whether yours was one of the accounts tried, and you do not need to run any of Microsoft's checks yourself.
If you stored AI keys in OpenCode, replace them
This one matters if you, or someone who builds for you, used OpenCode.
An AI key works like a password to a paid account with an AI provider such as OpenAI, Anthropic or Google. Whoever holds the key can run up the bill.
Attackers broke into an older OpenCode system and reached 1.4% of the users of OpenCode Console, where some people store their AI service keys. That figure comes from OpenCode itself, as TechCrunch reports it. Some users reported charges in the hundreds of dollars on their AI accounts, and a few reported more than $1,000.
OpenCode told affected users to cancel and replace their keys directly with each AI provider. That means signing in to OpenAI, Anthropic, Google or whichever provider you pay, cancelling the old key there and making a new one. Changing the key inside OpenCode alone does nothing about a copy someone already took.
If a freelancer or a developer set up the key for you, ask them today whether it lived in OpenCode Console. Then open each provider's billing page and look for usage on days nobody was working.
Claude Duet can buy things for your business, after you say yes
Anthropic opened Claude Duet as a research preview for Pro and Max subscribers in the US, through a waitlist, on iOS, Android and the web. It can buy things for your business through Stripe's Link wallet, and it can also check out with Shopify's Shop Pay.
For most shops that is a new kind of app: one that does not just suggest an order but places it.
Anthropic says Duet shows you the exact action and waits for your approval before it sends a message, makes a payment, signs a document or deletes anything. That approval screen is where your money is protected, so treat it like a check you are about to sign. Read the item, the quantity, the price, the seller and where it ships before you tap yes.
A good first test is a reorder you already make every month from a store you already use. If the approval screen shows exactly what you would have ordered, you have learned how it behaves. Paying a new vendor, or buying anything you cannot return, can wait until you have seen it get the small orders right.
The PHP patch is still this week's first job
On October 21, 2026, PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical bugs that let an attacker run code on a server without logging in. This was the subject of yesterday's post, and if your site runs on PHP it is still the most urgent item on this list. One message to your host settles it: ask whether your site is on one of those four versions.
What to do
- Ask your IT provider whether they use ConnectWise's cloud backup for your email or files, and whether your account was one of the ones tried.
- If they do use it, ask them to keep the affected ConnectWise app connections switched off until ConnectWise sends formal instructions to restore them, as Microsoft advises.
- Ask the same provider how they would restore your files this week while the backup service is paused.
- If your AI keys were ever stored in OpenCode Console, cancel each one and make a new one directly with each AI provider. Then check each bill for charges you did not make.
- If you try Claude Duet, read every purchase on the approval screen before you say yes.
- Send your host one line asking whether your site runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Every website Your Wish Is Our Code builds is yours from the first day, the code and the accounts both.