ConnectWise application identities exposed Microsoft 365 tenants
ConnectWise says attackers obtained unauthorized access to Cloud Backup application identities and used trusted Microsoft 365 connections. The company disabled seven application identities and suspended Cloud Backup; scheduled backups and restores remain unavailable. ConnectWise says existing archives are preserved, but previously issued tokens may remain valid and tenant-level changes require separate investigation.
Why it matters to you
MFA does not protect application-only authentication. Preserve Entra and Purview evidence, disable the listed app IDs, inspect service-principal credentials, roles, consent grants, federation trusts and mailbox rules, then verify the latest usable recovery point while backups are paused.
Drupal warns critical RCE paths may become exploitable quickly
Drupal fixed critical remote-code-execution flaws in the core Field UI module and the contributed Entity List module. Neither is directly exploitable alone, but contributed modules or custom code can expose serious chains, including known paths that require no authentication. Supported sites should move to Drupal 10.6.19, 11.3.19 or 11.4.10, and Entity List 3.0.10.
Why it matters to you
Inventory both core and contributed modules rather than checking the CMS version alone. Patch promptly, review custom integrations that invoke Field UI or Entity List functionality and, if core cannot be updated immediately, uninstall Field UI as Drupal's stated mitigation.
Bank of England says AI-agent accountability must be resolved
Bank of England governor Andrew Bailey warned that AI agents conducting financial transactions can blur accountability and legal liability when something goes wrong. He called model testing a priority and said regulators need to address the issue as agents move from advice into consequential action.
Why it matters to you
For SaaS agents, define who authorizes each action and who bears the outcome before enabling payments, purchases or account changes. Use explicit confirmation, transaction limits, deterministic policy checks, replayable decision logs and a human dispute path.
Anthropic warns the window for AI safeguards is shrinking
Anthropic co-founder Jack Clark told policymakers that model capabilities are improving faster than expected and called for strict human oversight and transparency around biological research. He also described a conditional internal forecast in which AI could lift US GDP sharply by 2030, while stressing risks from biological and cyber misuse.
Why it matters to you
Separate capability claims from deployable product value. For high-risk AI features, constrain tools and data by domain, require qualified human approval, version evaluations with the exact model and permissions in production, and preserve a non-AI fallback.
Only a minority of planned US AI data-centre capacity looks credible
A Financial Times review says at least 47 large US AI-infrastructure projects have been delayed or cancelled in 2026, amid financing pressure, permitting resistance and construction problems. It estimates that only about 35% of announced development is presently credible, despite headline plans worth trillions of dollars.
Why it matters to you
Do not treat announced megawatts as usable capacity. Score providers on committed financing, land, permits, grid interconnects, cooling, network paths and delivery history; avoid unprotected long prepayments and keep workloads portable across regions and operators.