Kategorie

After a lengthy Microsoft 365 outage disrupted business around the globe, Microsoft is now restoring services to its customers. As of 6:00 p.m. UTC (1 p.m. ET) on Friday, Nov. 13, Microsoft said that it is seeing broad recovery and stability across its services, although it is still reporting service degradation in Microsoft 365 services that interact with Exchange Online.

“Given the scale of demand, we restored services gradually, validating stability at each stage. While this took longer, it helped ensure a stable restoration,” the company said on its service health dashboard, noting that the global outage was not caused by a cyberattack or by AI.

It was, Microsoft said, a technical issue “introduced by an earlier network capacity upgrade that surfaced following a recent network change.”

A long list of services has been unavailable or intermittently impacted since the outage began more than 24 hours ago. Currently, the company says that elements of Microsoft 365 products that interact with Exchange Online and email services may be affected in various ways, but components of that don’t rely on that interaction remain functional.

Aside from email itself, which may be delayed or inaccessible, some potentially unexpected products are suffering.

For example, users may not be able to load some Microsoft 365 Admin Center pages, and Cloud Update, Cloud Policy, and Inventory in Microsoft 365 Apps Admin Center are affected. Users may not be able to load Copilot 365 Chat or receive responses from either the web version or the app, and Microsoft Intune device enrollment, device check-in, and device compliance policies “may have been intermittently impacted.” A long list of functions in Microsoft Purview and Microsoft Teams are impacted, and customers who have configured their Windows 365 tenant and Cloud PCs to use Microsoft Purview Customer Key for Windows 365 Cloud PCs may have users who are unable to connect to their Cloud PCs.

As well, users of Microsoft 365 apps such as Word or Excel may be unable to view recently used files.

A Microsoft update posted at 8:00 p.m. UTC (3 p.m. ET) said, “As infrastructure stabilizes, we’re still draining queued messages and rebalancing traffic, so customers may see improved sign-in/access while delivery and processing continue to catch up. We do not have an ETA for full recovery yet. Service access can recover before mail flow fully normalizes.”

Recovery from the outage creates opportunities for cyber criminals. Matt Hull, vice president of cyber intelligence and response at NCC Group, warned, “cyber criminals will be moving quickly to exploit the uncertainty, disruption and frustration that events like this create. Organizations should remind colleagues to be particularly vigilant, verify any unexpected contact through established channels before acting, and report anything suspicious without delay.”

He noted that social engineering is a particular concern, as attackers impersonate Microsoft or internal IT teams. “We could see attempts to convince people to reset passwords, approve multi-factor authentication requests or provide remote access to their devices,” he said.

Microsoft has promised a full post-incident report once its review is complete, and said in its status update,“We are deeply sorry for the disruption this incident has caused you and your business. We know the trust you place in our services and take that responsibility extremely seriously.”

Related: Microsoft 365 caught a bug and the whole world sneezed

Cryptocurrency hardware wallet maker Trezor has confirmed that three Safe 5 devices sold by Southeast Asian reseller CryptoBilis contained malicious hardware implants designed to steal wallet recovery phrases and send them to attackers over cellular networks. [...]

German defense technology company Quantum Systems confirmed that it detected an incident in late October that was part of an active cyberattack by "hostile actors." [...]

A type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server. Updates released yesterday fix it, along with 51 other security flaws. Full protection from this flaw also requires rebuilding any C-language extensions installed on the server. The flaw, tracked as CVE-2026-6460, has a CVSS score of 8.8. Any code run this way has the rights of the operating Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Moving a patient portal from one data center to another moves where the service runs. But it does not move who has to secure the patient data associated with the portal.

Nightmare Eclipse, the pseudonym of a researcher with an ongoing, very public beef with Microsoft, has dropped yet another Windows zero-day.

On Tuesday, Nightmare Eclipse disclosed SignDrop, a vulnerability that gives local users full System rights on some versions of Windows. The vulnerability resides in the Common Log File System, which Microsoft describes as a “general-purpose logging service used by software clients running in user-mode or kernel-mode.” By forcing a privileged process such as Windows Defender to open a crafted CLFS container, an attacker with ordinary user rights can abuse the privileged file creation to elevate privileges to System.

Turning a Windows defense against itself

The attack exploits the interaction of CLFS, Windows Defender, and Windows file permissions. The exploit uses Windows Defender to open a log file created by a standard user by calling ServerMpUpdateEngineSignature, a legitimate Defender function for processing antivirus signature updates.

Read full article

Comments

Vulnerable Check Point Security Gateway instances have been targeted in PHP2Shell attacks that deployed data-wiping malware on VMware ESXi hosts. [...]

Two security flaws in NVIDIA Linux drivers could allow someone with limited access to a server to gain full control of it. NVIDIA has already released fixes for both issues, but they came in separate updates. This means your driver might have received a fix for one flaw while still being vulnerable to the other. 

Be very careful of this newly discovered vulnerability in the Apache web server. Specifically, the vulnerability could allow attackers to execute code of their choice on your Linux web server(s) by targeting HTTP/2-enabled servers. So, first determine if your site(s) even use HTTP/2 and then check if a fix is already available for your specific version of Apache.

Someone managed to use stolen developer and bot accounts to fetch build credentials through ordinary-looking GitHub pull requests. The activity started on November 10, 2026, and two days later, security researchers from Aikido and StepSecurity uncovered the details of the campaign in their blog posts.

November 12, 2026, was a big day for security fixes to PostgreSQL. Now that there is a new version of the software, some database indexes may need rebuilding and new backups may need to be made, in addition to installing the update and restarting PostgreSQL.

Two attacks made public this week allow a malicious host to read data inside AMD SEV-SNP-protected virtual machines (VMs), which are built to keep the server's operator out. One of them, Mior, can also modify a VM's memory and fake the signed report confirming which software it runs. Both need control of the server's hypervisor, and Mior also needs control of the server's BIOS. Researchers Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

An AI agent built to automate invoice processing could be manipulated into changing vendor bank details through a malicious email, without triggering traditional security alerts. Token Security examines five critical AI agent security gaps and shares practical guidance from industry security leaders on preventing them. [...]

The U.S. Federal Bureau of Investigation (FBI) has established that threat actors tied to the Democratic People's Republic of Korea (DPRK aka North Korea) have stolen more than $400 million worth of cryptocurrency as part of a social engineering scheme codenamed FaceStealer in the last 18 months. As part of a coordinated set of actions announced by the U.S. government, the cloud-based Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Three Trezor Safe 5 wallets bought from the reseller CryptoBilis contain an implant, an extra circuit board that can copy their recovery phrases, hardware wallet maker Trezor said yesterday. The implant reads the phrase from the wallet's screen and sends it over the mobile network to a server controlled by the attackers. The company examined one of the wallets in its lab, identified the other Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Microsoft warned customers earlier this week that the November 2026 security updates may break printing for documents with complex formatting. [...]

Suppose an AI agent is asked to sort support tickets and look up account details. A ticket contains instructions that lead the agent to export records to an unfamiliar destination. The agent can make the request because its identity has access to the records and its connected tools allow the action. That kind of scenario raises a response question: what does “stop the agent” actually mean? A [email protected]

Suppose an AI agent is asked to sort support tickets and look up account details. A ticket contains instructions that lead the agent to export records to an unfamiliar destination. The agent can make the request because its identity has access to the records and its connected tools allow the action. That kind of scenario raises a response question: what does “stop the agent” actually mean? A

**Microsoft opravil 1094 zranitelných míst ve svých produktech. **Servisní aktualizace vyšly 10. listopadu 2026 večer. **Windows 11 získávají kompaktní a přizpůsobitelnou kontextovou nabídku.

A newly identified spying group used hacked equipment inside Asian mobile operators to intercept the calls and texts of selected people, mostly in Taiwan. Enea, a telecom and cybersecurity software company based in Stockholm, found the group's attack sources in at least six Asian countries and named it SilentAir this week. It assessed with high confidence that SilentAir is a state-level actor, Swati Khandelwalhttp://www.blogger.com/profile/[email protected]