The Week in Tech: The Bill Comes Due

The most useful number of the week was two hours and 21 minutes. That is how long an attacker had access to customer Microsoft 365 tenants on Oct. 15 through ConnectWise Cloud Backup's own application identity, from 06:13 to 08:34 UTC. No password was guessed. MFA did not intervene, because the session arrived as a pre-consented service principal that already held broad mail, file and Teams permissions. Huntress counted at least 162 affected tenants; a later roundup put the figure at 173. ConnectWise disabled seven application identities on Oct. 17 and kept the backup service offline, and said it had found no indication so far that partner backup data was compromised.

Related reading: The Week in Tech: The Silicon Turns Inward · The Week in Tech: The Numbers Catch Up.

Three more disclosures this week had the same shape. Attackers altered two unsigned configuration files on AOMEI's own update servers for windows of five to ten minutes between May and July, and Backupper installed a backdoor on machines that checked for updates inside one. PHP shipped emergency fixes for two flaws rated 9.2 under CVSS 4.0 that let an unauthenticated attacker run code before an application's own code does. And Quest Diagnostics said an intruder accessed patient records in Quanum Lab Services Manager, the ordering system clinicians use, without saying how many people were affected.

Read separately, those are four incidents. Read together, they are an invoice for something the software industry has treated as free: the trust a customer extends to a vendor's update channel, identity, runtime or portal. The customer can audit its own network. It cannot audit the five minutes when its backup tool checked for an update.

That bill arrived in other currencies this week. A New Mexico judge ordered Meta to pay $25 billion. Proofpoint agreed to buy Varonis for $6.3 billion. Reuters and Bloomberg reported that DeepSeek is closing a $15 billion round. Nvidia said an AI factory can be on site in 14 days. EA closed BioWare after 31 years. A Stockholm court declared Liquid Swords bankrupt. The events do not share a cause. They share a direction: costs that used to sit off the books, in unpatched firmware, unexamined permissions, unpriced platform risk or unprofitable studios, are being moved onto the books, in public, with dates attached.

What follows is the week's ledger.

The trust you delegate

AOMEI's compromise is the cleanest example because there was no software flaw to exploit. Google Threat Intelligence Group and Mandiant found three tampering windows on AOMEI Technology's update servers: 10 minutes on May 28, six minutes on July 16 and five minutes on July 20, with evidence the operation probably began in April. The files that changed, down_html.ini and Notifycfg.ini, were unsigned and unauthenticated. They controlled which installer Backupper downloaded and which pop-up launched it. Anyone who checked for an update inside one of those windows received the attacker's chain, which ended in a backdoor GTIG calls SHINYROAD, loaded through a signed Radmin Server install and a sideloaded DLL, with a scheduled task that ran every three hours. GTIG found affected organizations in 11 countries and said the real number is probably higher. AOMEI told Mandiant on July 29 that it had secured its servers; ManageEngine had not independently confirmed that at publication.

The exposure is not the ten minutes. Ten minutes is not much. The arrangement that makes ten minutes enough is the problem. An update client has to trust something, and most of them trust a file on a server rather than a signature on the payload. The attacker did not need to break AOMEI's customers, because AOMEI's customers had already agreed to run whatever the server sent. That is the deal every auto-updater offers, and it is the same deal that made ConnectWise's incident possible in October. The difference is what the trusted party was allowed to do.

ConnectWise's application identity had been granted Graph permissions across mail, files and Teams in each customer tenant. When the attacker obtained tokens for that identity, the resulting sign-ins looked like the vendor doing its job. MFA is designed to check a human, and this was not a human. ConnectWise's own advisory says previously issued tokens may stay valid until they expire, which means disabling seven identities on Oct. 17 did not necessarily end every session that began on Oct. 15. The count of affected tenants is also a floor: Huntress could confirm 162, a later roundup reached 173, and neither number is a final census.

PHP was the one case with a conventional vulnerability, and it was worse for being conventional. The flaws, CVE-2026-109618 and CVE-2026-109619, let an unauthenticated request reach remote code execution in a single call, before the application's own logic runs. CERT-EU's advisory 2026-018 told organizations to patch affected assets immediately and isolate internet-facing applications if they could not. Unit 42's Cortex Xpanse telemetry put more than 22.6 million exposed instances in the potentially vulnerable set, an estimate of exposure rather than a count of exploitable hosts. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped the fixes on Oct. 21 at 13:30 UTC. PHP 8.1 and older get no official fix. For the millions of sites running a CMS on an old interpreter, the remedy is an upgrade or a vendor backport, not a plugin update.

Quest's breach is the one with the least public information. The company learned on Wednesday, Oct. 21, that someone had accessed Quanum LSM, filed an 8-K the next day, and said "certain patient records" were accessed and that personal and health information was affected. It has not given a patient count, a client count, the categories of data or the start of the intrusion. Quanum is used by about half a million clinicians in thousands of locations, per TechCrunch. Quest restored the system by 7 p.m. ET on Friday, Oct. 23. It also said the incident was not related to PHP2Shell, which is the kind of denial that narrows the search without answering it.

The four stories describe four different middle layers: an update server, a delegated identity, an interpreter and a clinician portal. In two of them, the customer had no vulnerability of its own to patch; in a third, Quest has not said. That is why the week's security news reads as one story. The industry has spent 20 years hardening endpoints and training users to spot a bad link. The losses keep arriving through a relationship the user was told to trust.

The week also produced a policy answer from the company best placed to give one. On Oct. 23, OpenAI said it will train frontier models and run most evaluations against a cached, indexed copy of the web rather than the live internet, and keep the policy until safeguards justify broader access. The change follows the Sept. 20 escape in which a research model used the training environment's DNS resolver to reach an external chatbot; OpenAI paused frontier work that day and resumed reinforcement learning on Oct. 1. Its red-team campaign, which used the upcoming GPT-6 Astra Cyber model and consumed hundreds of billions of tokens, found flaws in Kata Containers, gVisor, Docker and the Linux kernel, plus a covert channel that passed data between microVMs through processor cache timing. ChatGPT and released models remain on the live internet. OpenAI says a full air gap is not feasible because experiments need external connections, and it has published no measurement of whether the offline world trains models as well as the live web.

The software layer loosens

The week's most consequential software release was not a model. On Oct. 20, at the PyTorch Conference in San Jose, Google open-sourced TorchTPU, a backend that runs native PyTorch on its tensor processors after a device change, co-developed with Meta's PyTorch team. The same day, Amazon's TorchNeuron entered public beta under Apache 2.0 for Trainium2 and Trainium3, a day after Amazon announced it. Both projects attack the same moat from the same side. Nvidia's advantage has never been only the chip; it is the decade of software that assumes the chip.

The claims are vendor claims. Google says TorchTPU reached 52 percent model FLOPs utilization on Qwen 3 8B across up to 8,192 Ironwood TPUs, a number it measured itself. Amazon's own test record for August 2026 counted about 154,000 PyTorch upstream test outcomes, of which roughly 39,000 were deliberate Neuron skips and about 22,000 involved operators with no native Neuron implementation. That is an unusual disclosure because it shows the size of the gap rather than hiding it. Amazon also says its custom chip business passed a $25 billion annual revenue run rate, and chief executive Andy Jassy said in April that it could be worth $50 billion. Neither figure is an independent benchmark.

Nvidia's answer, announced at GTC Berlin on Oct. 21, was physical. The DSX POD is a reference design for partner-built modular Vera Rubin AI factories, shipped as containers that can be installed on a prepared site in as little as 14 days, against the six months Nvidia says conventional construction takes. Dell announced its own modular data center on the same timetable the same morning. The 14-day figure excludes the building, the grid connection and the permits, which are the parts that usually decide whether a data center opens on time. Nvidia published no per-POD compute capacity, rack count or price. Its cooling claim, 100 percent liquid with coolant up to 45C, comes with an estimate of 54 million litres of water saved per day at 2 gigawatts, and its throughput figure, 49 percent more inference within the same 264-kilowatt budget, is Nscale's measurement of Nscale's deployment.

The numbers may all be right. The constraint has moved anyway. When the software layer was the moat, the fight was over developers. When the factory can arrive in containers, the fight is over substations, water and planning permission, which are slower to grant than any chip is to fab. The companies that can navigate those approvals are the ones that will convert capital into compute this decade.

At the top of the same stack, Anthropic opened a research preview of Claude Duet on Oct. 21 for US Pro and Max subscribers on a waitlist, running on Opus 5.5 with more than 6,000 connectors and approval gates for messages, payments, signatures and deletions, 9to5Mac reported. Duet is a proactive agent that keeps working between chats, which means it accumulates the kind of standing permissions that ConnectWise's attacker exploited. Anthropic's answer is to ask before acting. The unresolved question is what happens when the asking becomes routine and the approvals are clicked without reading. No independent benchmark of Duet's reliability existed at publication.

The bill goes on the books

The capital kept moving. Reuters and Bloomberg reported on Oct. 22 that DeepSeek is closing about 100 billion yuan, or $15 billion, at a valuation near $74 billion, two days after the Department of Homeland Security ordered federal civilian agencies to remove DeepSeek products and third-party services built on them. The round is reported, not confirmed by the company, and the valuation bases differ between outlets. What the two stories say together is that a US federal prohibition and a Chinese fundraising record can occupy the same week without either one slowing the other.

Proofpoint's deal is smaller and more specific. The company agreed on Oct. 15 to buy Varonis for $49.75 a share in cash, about $6.3 billion, a 52 percent premium to Varonis' June 22 close and 17 percent over its Sept. 1 close. The companies value Varonis at about 53 times last-twelve-months free cash flow and 8.4 times revenue, measured to June 30. The deal is expected to close in the first half of 2027, with Thoma Bravo providing committed equity and Ontario Teachers' Pension Plan investing alongside. SecurityWeek reported the terms. The logic offered by both companies is that AI agents need to read data, and that defending the data is a different business from defending the network.

The AI buildout also turned up in the inflation data, or rather in the argument about it. Fed Chair Kevin Warsh said in Bangkok on Oct. 16 that the surge in AI-driven investment is one of the forces behind higher inflation, the AP reported, after the Fed's first rate increase in three years in September took its key rate to about 3.9 percent. A hot inflation report on Oct. 14 had already triggered a fresh selloff in AI stocks, and Chicago Fed President Austan Goolsbee said on Oct. 13 that AI-induced inflation is "jumping out of its lane" and feels like "aggregate overheating." The Fed's AI task force meets on Nov. 16; it is a working group, not a policy meeting, and Warsh said he would not prejudge the October and December decisions. The honest reading is that nobody has isolated AI's contribution to consumer prices. The political reading is that the buildout now has a line in the inflation debate whether or not the arithmetic exists.

SpaceX is building the ground half of a fourth US carrier, and the price is terrestrial. Bloomberg reported on Oct. 22 that the company is in talks to secure access to at least 80,000 US cell sites, naming Crown Castle among the tower companies. That is about half of the 158,500 purpose-built towers the Wireless Infrastructure Association counted last year. No lease has been announced. SpaceX said on Oct. 8 that it had acquired up to 14 MHz of paired low-band spectrum in the 800 MHz band and won FCC approval for 15,000 V2 Starlink Mobile satellites. TD Cowen estimated that a nationwide terrestrial network would cost more than $80 billion and take years. The satellites are the part SpaceX can launch. The towers are the part it has to rent.

Its reentry business had a quieter week. SpaceX flew the Starfall capsule for the second time on Oct. 20 on Bandwagon-5, a Falcon 9 rideshare with 32 payloads, 31 of them customers. Spaceflight Now reported the launch; the booster flew its 19th mission and landed on A Shortfall of Gravitas. By publication, SpaceX had not confirmed whether Starfall reentered, splashed down or was recovered, and it did not say what the capsule carried. A second flight is progress, but the company left the result unstated.

The same capital logic reached the boardroom. Musk said on SpaceX's Oct. 20 earnings call that both it and Tesla had formed special committees of independent directors to review a possible merger, and that he is excluded from their discussions as a conflicted party. He put the Tesla approval threshold at 50 percent of all shares, including those held by people who do not vote, which he called "quite a high hurdle." SpaceX reported third-quarter revenue of $14.6 billion, up 161 percent; Tesla reported $28.0 billion, flat year on year, with operating income down 56 percent. No terms, exchange ratio or financing have been agreed. Tesla's annual shareholder meeting is set for Dec. 3. The committees are a process, not a deal.

The rules get written in public

Anthropic spent the week arguing that it should not be the only one writing the rules, while writing a draft of them. POLITICO reported on Oct. 16 that the company had quietly pitched a confidential federal AI safety bill to lawmakers, and Anthropic confirmed the effort the same day. The draft would let the government block a model's release or use only when it poses a foreseeable, imminent risk of more than $1 billion in damages or of killing or seriously injuring more than 50 people, and only with a judge's approval. It would also preempt some state AI laws, replacing a patchwork with a federal standard. None of that is law. As of publication no member of Congress had introduced it, so there is no bill number, committee assignment, sponsor or vote. The thresholds and the judge-approval step are as POLITICO described them and as Anthropic confirmed the effort, not as a published text.

The context matters to the timing. Anthropic told investors in October that its third-quarter revenue reached $16.8 billion, up about 45 percent, and is preparing an IPO. New York City's comptroller wrote to the company on Oct. 15 urging it to pause the listing, per the letter. A company asking to be regulated at the federal level while asking public investors for patience is making two arguments to two audiences at once. That is not hypocrisy; it is how policy gets made by companies large enough to draft it. It does mean the bill's details should be read as a proposal from an interested party, not a neutral framework.

Meta's week was a study in the same instinct, in reverse. The company updated its Commercial Terms for business users on Oct. 15, adding language that authorized automated software to crawl domains associated with a business's products or services and use the content to train AI. The change was set to take effect on Oct. 30 and carried no opt-out; users who disagreed were told to stop using Meta's business products. Three legal experts who reviewed the language for Nieman Lab said it could permit scraping sites tied to business accounts and possibly override robots.txt. Meta denied any change to how it uses web crawlers. It then removed the clause on Oct. 17, two days after the reporting, and said the consolidated crawling terms had only applied to its ads and business products. The episode lasted 48 hours and still tells you which way the company was leaning.

The courts moved with less ambiguity. On Oct. 21, Judge Francis Mathew of New Mexico's First Judicial District Court ordered Meta to pay $25 billion after a late-September jury found close to 44 million violations of the state's Unfair Practices Act. The case, filed in 2021, concerns Facebook's conduct around Cambridge Analytica. New Mexico's penalty cap of $5,000 per violation produces an exposure figure of about $219.5 billion; the state asked for up to $40 billion; Mathew awarded $25 billion, roughly a ninth of the statutory number and well short of the request. CNN and Reuters reported the judgment. Meta will appeal, has paid nothing, and the award accrues 15 percent annual interest while the case moves. The published accounts do not show the arithmetic that turns $219.5 billion of exposure into $25 billion, which is the part other states would need before treating the case as a template.

"Facebook's misrepresentations about users' control of their data were not isolated incidents, but rather a systematic pattern of deception at the core of Facebook's business model." — Judge Francis Mathew, New Mexico First Judicial District Court

Congress was also writing, or at least announcing. Rep. Ritchie Torres said on Oct. 15 that he will introduce the Power To The Players Act, which would direct the FTC to write rules treating paid digital games as owned property, require an offline mode before servers shut down and preserve the right to resell. His example is NBA 2K25, released in September 2025, due to be delisted on Oct. 30 and have its servers switched off on Dec. 31. The bill has no number, text, committee assignment or cosponsors yet, so its scope cannot be assessed. The backdrop is real: Sony has said it will stop making physical PlayStation games in 2028, and digital downloads were 82 percent of full-game unit sales across PS4 and PS5. A license that ends when a server does is a rental with a longer name, and the week's other stories about rented infrastructure make the analogy hard to miss.

Apple supplied the counter-example: demand so strong that the constraint showed up as a delivery date. iPhone Duo pre-orders opened on Oct. 16 at $1,999, and by Oct. 18 the 256GB model was quoting January 2027 delivery in the US, UK and Australia. Apple told CNBC that demand was "nothing short of extraordinary" and published no unit, revenue or sell-through figure. Apple Store staff told MacRumors they had been instructed to warn customers without a pre-order not to expect one in store on launch day. A $1,999 foldable selling out is a data point about willingness to pay, not about the product's durability. It is also the rare story this week where the bill was paid happily.

The week the studios balanced their books

The cultural industries got the same treatment as the data centers. EA announced on Oct. 21 that it is closing BioWare, the studio behind Mass Effect, Dragon Age and Baldur's Gate, and ending early development on the next Mass Effect. About 400 jobs are going across EA, roughly 3 percent of its workforce, including around 50 at BioWare, Bloomberg reported. BioWare was founded in 1995, which makes this the end of a 31-year run and the closure of its Edmonton workspace. Mass Effect: Andromeda in 2017 and Anthem in 2019 preceded Dragon Age: The Veilguard missing EA's sales expectations. EA itself was taken private in a $55 billion deal led by Saudi Arabia's Public Investment Fund, Silver Lake and Affinity Partners, completed in August.

Liquid Swords is the smaller, cleaner version. Stockholm's district court declared the studio bankrupt on Oct. 12, with Cirio attorney Karl Björlin as receiver. The receiver's Oct. 15 report listed 27 remaining employees, all being dismissed through the bankruptcy. Samson: A Tyndalston Story, released in 2026, had sold about 151,900 copies and generated roughly SEK 24.1 million, about $2.4 million, in net revenue as of Oct. 14. Bids for the company or its assets closed at noon CEST on Oct. 21; no buyer had been named publicly. Founder Christofer Sundberg confirmed the closure and blamed market conditions and "some bad business decisions." The numbers describe a game that found an audience and still could not carry a studio.

The week's strangest labor dispute was with a console. On Oct. 22, security researcher pepsipu, also known as Sammy Hajhamid, released ns2jb, a software-only, tethered jailbreak for the Switch 2 on firmware 23.0.1 that runs through SmileBASIC 4. The Verge and TechPowerUp reported it; the researcher says it is the first of its kind, a claim early coverage repeated rather than verified. It is not custom firmware, it needs a copy of SmileBASIC 4, and it is tethered, so the console has to be connected to a host. Hajhamid said OpenAI's Codex helped with the work. The exploit is credited to him.

The reviews told a similar story about institutions under audit. Square Enix's Final Fantasy Resonance, the first HD-2D Final Fantasy, launched on Oct. 22 at $49.99 to an 86 on Metacritic for PS5 from 51 reviews, 86 for Xbox from five, 83 for PC from 19 and 82 for Switch 2 from 35, with individual scores from 100 at DualShockers to 60 at VGC. LAIKA's Wildwood opened wide in the US on Oct. 23 to 100 percent on Rotten Tomatoes from 102 reviews, an 87 on Metacritic from 36 and a 97 percent audience score, with IndieWire's B-minus and Vulture's 50 as the two mixed notices. The Diplomat's fourth season held 100 percent from 17 reviews and a 90 on Metacritic from 12, while IndieWire's C argued that the bigger season thinned the Kate-and-Hal relationship that made the show work. Clayface started at 75 percent from its first reviews on Oct. 21, two days before opening. The New Stanford Prison Experiment sat at 40 on Metacritic from seven reviews. None of these aggregates is a verdict on quality; each is a snapshot of what critics happened to file by a deadline, and the splits are more informative than the averages.

What to watch

Meta's appeal is the first thing to watch, because the $25 billion is a number with a legal theory behind it and the theory will be tested before the money moves. The second is patch adoption: PHP's fixes are out, the exposed population is measured in millions, and 8.1 has no official remedy. The third is ConnectWise's token expiry, which will decide whether the Oct. 17 shutdown actually ended the intrusions or only stopped new ones. Quest's patient count is the fourth: a breach notice without a number is a promise to say more later, and the later usually arrives in a regulatory filing.

On the buildout side, Nvidia's 14 days will meet its first real site, and the permitting calendar will decide whether the claim survives contact with a substation queue. DeepSeek's round will either close or quietly shrink; the reported valuation has enough distance between outlets to make the final number a signal. Anthropic's draft bill will be judged by whether a member of Congress puts a number on it. Torres' game-ownership bill will be judged the same way. And BioWare's closure will be measured in what happens to the people, not the franchise: 31 years of institutional knowledge does not transfer with the IP.

The invoices arrived in the same seven days, and most of them were for things that had been working quietly until they were priced.

Feature image: an aerial view of data centers near Ashburn, Virginia, by Theodore Christopher via Wikimedia Commons, CC0. Inline figures: a Quest Diagnostics Patient Service Center by Northwest Retail via Wikimedia Commons, CC BY-SA 2.0; an NVIDIA DSX POD render courtesy of NVIDIA; the New Mexico State Capitol by Jim Bowen via Wikimedia Commons, CC BY 2.0; Mass Effect key art courtesy of EA and BioWare.