Cyber News

What’s Happening in Cyber (13 NOV 2026)

Posted on by Eric Jackson in Cyber News

The Human Take

Happy Friday the 13th! It’s getting hot out there in Cyber. All kinds of incidents, attack frameworks and so much more happening. And I recommend you read about it… But…

How about Microsoft Office, huh?

If you aren’t aware, Microsoft has been having a not-so-good, very-awful and ugly time of things, lately. They’re in the news here that Rebecca pulled, but unbeknownst to her when she was looking for Cyber stories at 0600 in the morning on Thursday, about 5 hours later, Microsoft Office would go out. Not just for me, but for everyone. In the world. If you were working yesterday, you were probably effected. Even if you don’t use Microsoft products, colleagues, clients and associates do. They were down even if you weren’t. In addition to the productivity suite going down, Windows services themselves were degraded, to include some critical security functions. In addition to this (still ongoing as of writing), Microsoft is in the process of shedding 60k employees through attrition and buyouts, also known as the more expensive form of the layoff.

If this was your local IT company, or a consulting group, you would think they are in serious trouble, and may want to stop doing business with them. But this is Microsoft. They are IT. They can’t be in trouble, can they? When we approach a security issue, the first question to ask is, “Is this worth it?” Do I want to keep hooking my business to companies that promise to make my job easier but instead introduce outages and security risks to my company? The belief that AI and cost reduction will save companies is starting to not just prove unlikely, but it may be that the opposite is coming down the line. Cloud providers sold businesses on outsourcing business uptime and security to them through their services, and here we are, having done that, now experiencing an outage every time some other company experiences one.

It may feel like I’m picking on Microsoft here, but it’s not just them. Pick any cloud provider out there, this is going to keep going. Hackers only have to be right once to get in. If you’re protecting yourself, you have no one to blame but yourself if you have an outage or go down to an attack. But there’s a truth that no one tells you about when you outsource your uptime and security. If someone else is protecting you, you still have no one to blame but yourself if you have an outage or go down to an attack. Clients and customers are never going to be okay with “it wasn’t our fault we got hacked.”

Jason (of Jason X) is pretty big on patching. Little known fact.

Weekly Cyber News Summary November 12, 2026

This week in cyber:
  • UK leads Europe in state-sponsored cyberattacks, AI compresses attack timelines
  • SkyW4lker, Fake AI, GeorgeGinx campaigns target US enterprises across sectors
  • AI-driven breach of DIVD network, record ransomware, rising GenAI data leakage
  • Australia may criminalize unsafe AI sales, ISO/IEC 42001 adoption accelerates
  • Apache HTTP Server CVE-2026-119618, Chrome Zero-Day CVE-2026-5281, Adobe CVE-2026-34621
  • DI VD network breached by AI agent via Zammad zero-days, Vanderbilt hit by ransomware
  • NIST SP 800-221r1 draft opens, Australia enacts mandatory Smart Product security law
  • Australia’s unsafe AI legislation, new stablecoin regulations, zero-trust mandates

State-Sponored Attacks

UK Emerges as Europe’s Most Targeted Nation for State-Sponsored Cyberactivity The United Kingdom has risen to become the most heavily targeted country in Europe for state-sponsored and geopolitical cyber activity, with 76 observed events recorded over the past year. According to Microsoft’s 2026 Digital Defense Report, the UK accounts for 3.8% of global cyber threat activity, ranking fifth worldwide. The report highlights that AI is compressing the attack lifecycle, enabling both cybercriminals and nation-state actors to deploy sophisticated campaigns in minutes rather than days. Phishing attacks surged from 7% to 23% of all incident-response intrusions year-over-year, while voice phishing jumped 502%. Ransomware detections in the UK increased by 66%, with attacks heavily concentrated against state and local government, education, and critical infrastructure sectors. Research and academia comprised 38% of all cyber attacks in that sector, followed by transport at 22%. Mike Yeh, Vice President of Customer Security & Trust at Microsoft, emphasized that “security in the AI era is no longer simply about preventing individual intrusions” but about ensuring institutions can operate in an environment where risks are interconnected and threats move faster. Public-private partnerships are cited as increasingly critical for securing government infrastructure and developing policies for emerging technologies.
Sources:
TechRadar: https://www.techradar.com/pro/security/uk-faces-the-most-state-sponsored-cyberattacks-in-europe-as-ai-narrows-the-attack-timeline-from-days-to-minutes
Microsoft Digital Defense Report 2026: https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2026-v1.1.pdf
SecurityMaisters: https://www.securitymaisters.com/nation-state-cyber-threats-2026-mid-market/
Denmark Raises Cyber Espionage Threat Level for European Telecom Sector Denmark’s cybersecurity agency has elevated the cyber espionage threat level for its telecommunications sector from medium to high, citing increased state-sponsored campaigns targeting European telecom companies. The upgrade reflects a broader wave of nation-state activity sweeping across Europe, with Denmark’s national security apparatus identifying a marked escalation in espionage operations aimed at critical communications infrastructure. The move aligns with broader regional trends showing sustained pressure on sectors with broad user bases and complex digital environments, as state actors increasingly prioritize telecommunications as a strategic target for intelligence gathering and long-term surveillance capabilities.
Sources:
Security Affairs: https://securityaffairs.com/175479/intelligence/denmark-warns-of-increased-state-sponsored-campaigns-targeting-the-european-telcos.html
The Cyber Express: https://thecyberexpress.com/cyber-warfare-2026-nation-state-attacks/
Check Point Software: https://www.checkpoint.com/cyber-hub/cyber-security/what-is-cyber-attack/nation-state-level-cyberattacks/
China-Nexus Espionage Framework Uncovers Year-Long Campaign A year-long investigation by Check Point Research has uncovered CopperDragon, a global Chinese-nexus cyber espionage framework that has been systematically targeting organizations worldwide. The campaign connected three distinct operational phases, revealing a sophisticated, persistent threat actor leveraging custom tooling and infrastructure to exfiltrate sensitive data across multiple industries. The discovery underscores the increasing depth and reach of China’s cyber espionage operations, which have evolved beyond simple data theft to include long-term positioning within critical sectors. The framework’s multi-phase approach includes initial compromise, lateral movement, and sustained data exfiltration, demonstrating the patience and precision characteristic of modern nation-state operations.
Sources:
Check Point Research: https://blog.checkpoint.com/2026/11/10/copperdragon-uncovering-a-global-china-nexus-cyber-espionage-framework/
The Cyber Express: https://thecyberexpress.com/cyber-warfare-2026-nation-state-attacks/
SecurityMaisters: https://www.securitymaisters.com/nation-state-cyber-threats-2026-mid-market/

Regional Campaigns

SkyW4lker Phishing Kit Targets US Enterprises with Microsoft 365 Device-Code Authentication SkyW4lker, an active phishing kit exploiting Microsoft’s legitimate device-code authentication, has been identified across 618 sandbox analyses between June and October 21, 2026, with 46% originating from the United States. Monthly submissions grew dramatically from 20 in June to 200 in September, targeting technology, government, education, finance, and consulting sectors. The attack begins with password-protected documents disguised as contracts, invoices, or business proposals. Victims pass through CAPTCHA checks and trusted platforms before reaching a page instructing them to enter a device code on Microsoft’s authentication website, granting attackers unauthorized account access without stealing passwords or bypassing MFA. ANY.RUN’s Related Threat Context revealed technical links to Gabagool, another phishing kit believed to share the same developer.
Sources:
ANY.RUN: https://any.run/cybersecurity-blog/major-cyber-attacks-october-2026/
The Hacker News: https://thehackernews.com/2026/11/5-active-cyber-threats-that-put-us.html
GeorgeGinx PhaaS Operation Exploits Adobe Shared Links Against US Government and Banking GeorgeGinx is an active Phishing-as-a-Service operation targeting US government, banking, healthcare, and IT organizations. Attackers exploit legitimate Adobe Shared Links to redirect victims to Microsoft device-code phishing pages, potentially gaining unauthorized access to corporate accounts without stealing passwords. ANY.RUN researchers used In-Browser Data Inspection to examine HTML DOM activity and HTTP requests behind trusted Adobe links, uncovering an administration panel on an attack server that provided deeper insight into the phishing operation’s infrastructure. The campaign leverages trusted document-sharing workflows to conceal phishing destinations, making them harder to detect than traditional phishing URLs.
Sources:
ANY.RUN: https://any.run/cybersecurity-blog/major-cyber-attacks-october-2026/
The Hacker News: https://thehackernews.com/2026/11/5-active-cyber-threats-that-put-us.html
WKLP Infostealer Weakens Microsoft Defender Across US and French Government Organizations WKLP, a Python-based infostealer and remote access trojan, has been observed targeting government organizations in both the US and France. The malware uses PowerShell to launch a legitimate Python runtime disguised as the Windows process MoUsoCoreWorker.exe. It collects credentials, browser data, password-manager information, and sensitive files while giving attackers remote control over compromised endpoints. WKLP adds Microsoft Defender exclusions, terminates security processes, and creates firewall rules disguised as Windows Update Service, weakening endpoint protection. The malware also features a watchdog mechanism that restores deleted malware copies, making complete removal difficult. Attackers can execute remote commands, deploy additional payloads, and access the victim’s screen, camera, microphone, and clipboard.
Sources:
ANY.RUN: https://any.run/cybersecurity-blog/major-cyber-attacks-october-2026/
The Hacker News: https://thehackernews.com/2026/11/5-active-cyber-threats-that-put-us.html

AI Integration

DI VD Network Breached by AI Agent Exploiting Zammad Zero-Day Vulnerabilities The Dutch Institute for Vulnerability Disclosure (DIVD) reported that its network was breached by exploiting a chain of two zero-day vulnerabilities in the open-source Zammad ticketing system: CVE-2026-102489 and CVE-2026-102490. The attack was described as “loud and very, very messy,” driven by an AI agent that moved autonomously, deciding its next steps without external intervention. The vulnerabilities enabled session hijacking, remote code execution, and escalation to root privileges. DIVD retrieved extensive details about the attack because the AI agent left behind clear explanations of its decisions. Zammad, used by over 2,000 customers including Amnesty International and NextCloud, recommends upgrading to version 7 or taking instances offline immediately.
Sources:
BleepingComputer: https://www.bleepingcomputer.com/news/security/divd-says-zammad-zero-days-enabled-ai-driven-network-breach/
HackWatch: https://hackwatch.io/alerts/actively-exploited-vulnerabilities-today
Wiz Blog: https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
Record 1,063 Ransomware Attacks in October, with n0n Extortion Group Rising to Top Three Check Point Research reported that organizations experienced an average of 2,550 cyber attacks per week in October, down 9% from September but up 32% year-over-year. A total of 1,063 ransomware attacks were reported—the highest in recent years and 35% more than in October 2025. The Gentlemen led with 13% of published attacks, followed by Qilin at 12%. The new n0n extortion group entered the top three within a month of its initial operation, accounting for 8% of published victims and quadrupling its monthly share. n0n made extensive use of AI-assisted tooling, with initial access relying on weak or stolen credentials. Business Services was the most targeted industry at 31.5% of victims, followed by Consumer Goods & Services at 14.9%.
Sources:
Check Point Research: https://blog.checkpoint.com/research/october-2026-cyber-threat-landscape-record-ransomware-rising-genai-risk-and-an-ai-powered-newcomer/
ANY.RUN: https://any.run/cybersecurity-blog/major-cyber-attacks-october-2026/
One in 35 Enterprise GenAI Poses High-Risk Data Leakage, Affecting 90% of Organizations In October 2026, one in every 35 enterprise GenAI prompts posed a high risk of sensitive data leakage, affecting 90% of organizations that regularly use GenAI tools. The global high-risk rate rose steadily from 2.3% (1 in 43) in August to 2.9% (1 in 35) in October. Latin America recorded the highest regional rate at 1 in 26 (3.8%), while Business Services had the highest industry exposure at 5.4%. Financial data was the most common sensitive category, observed in prompts at 71% of organizations, followed by legal and regulatory data and network infrastructure at 70% each. Each user generated an average of 91 prompts during the month, with each organization using an average of seven tools.
Sources:
Check Point Research: https://blog.checkpoint.com/research/october-2026-cyber-threat-landscape-record-ransomware-rising-genai-risk-and-an-ai-powered-newcomer/
CIO: https://www.cio.com/article/4157398/the-state-of-ai-security-in-2026.html
Cynet: https://www.cynet.com/security-foundations/ai-machine-learning/ai-cyberattacks/

AI Policy and Posture Adaptation

Australia May Make Knowingly Selling Unsafe AI a Crime Under New Legislation Australia may criminalize the sale of unsafe AI under new legislation that requires companies to maintain and publish safety and security frameworks to ensure good governance, risk management, and transparency. The proposed law would respond to updated standards and rules as technologies evolve, positioning Australia as a leader in AI regulation. The legislation aligns with broader global efforts to establish accountability for AI systems, requiring organizations to demonstrate that their AI products meet defined safety thresholds before reaching consumers. This approach mirrors the UK’s PSTI model while incorporating unique nuances suited to Australia’s regulatory landscape.
Sources:
The Register: https://www.theregister.com/public-sector/2026/11/11/australia-may-make-knowingly-selling-unsafe-ai-a-crime/5308999/
AI Compliance Center: https://ai-compliance.center/cases/283-2/
Dataiku: https://www.dataiku.com/blog/human-in-the-loop-ai-agents
ISO/IEC 42001 Implementation Gains Traction as AI Governance Standard Organizations are increasingly preparing for ISO/IEC 42001 implementation, the first international standard for AI management systems. The standard provides a structured framework for AI governance, requiring phased implementation guidance that fits naturally into existing workflows rather than slowing operations. Companies are conducting AI code and model reviews, performing compliance assessments under the EU AI Act, and establishing documented decision records at every oversight checkpoint. The standard is particularly gaining traction among enterprises that use human-in-the-loop AI agents, where each decision point requires documented records of what the agent proposed, what the human approved, and the rationale behind each choice.
Sources:
AI Compliance Center: https://ai-compliance.center/cases/283-2/
Dataiku: https://www.dataiku.com/blog/human-in-the-loop-ai-agents
Dextralabs: https://dextralabs.com/blog/enterprise-ai-cost-tco-framework/
Human-in-the-Loop AI Agents Drive New Governance Design Patterns Organizations are adopting human-in-the-loop AI agents that create documented decision records at every oversight checkpoint, establishing what the agent proposed, what the human approved, and why. This governance pattern is becoming essential as AI systems grow more autonomous and complex. Companies are building lightweight guardrails for agents, non-human identities, and Superblocks, requiring 2 to 4 years of IT risk, data governance, or information security compliance experience. The approach is particularly important in matrixed organizations where AI agents operate across multiple departments and systems, each requiring distinct oversight and accountability mechanisms.
Sources:
Dataiku: https://www.dataiku.com/blog/human-in-the-loop-ai-agents
HireHi: https://hirehi.ru/devops/ai-governance-risk-analyst-in-logistics-226859
AI Compliance Center: https://ai-compliance.center/cases/283-2/

Zero-Day Exploits/CVEs

Apache HTTP Server CVE-2026-119618: Critical RCE Affects 64% of Cloud Environments A critical synchronization vulnerability, CVE-2026-119618, was identified in Apache HTTP Server’s HTTP/2 module (mod_http2) on November 11, 2026. The flaw stems from a concurrent execution race condition within the assign_headers() function when handling shared resources. If successfully exploited, a remote, unauthenticated attacker can corrupt heap memory to achieve arbitrary code execution. The vulnerability was independently discovered by Anthropic and Google Cloud’s Vulnerability Research Team. According to Wiz data, 64% of cloud environments have resources vulnerable to CVE-2026-119618, and 51% have publicly exposed instances. Affected versions range from Apache HTTP Server 2.4.55 through 2.4.70, with patched versions available at 2.4.71 and newer.
Sources:
Wiz Blog: https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
HackWatch: https://hackwatch.io/alerts/actively-exploited-vulnerabilities-today
Chrome Zero-Day CVE-2026-5281: WebGPU Use-After-Free Bug Rated High Severity Chrome zero-day vulnerability CVE-2026-5281, a high-severity use-after-free bug in Dawn—the open-source, cross-platform implementation of the WebGPU standard—was actively exploited in the wild. The vulnerability allows attackers to execute code by manipulating WebGPU rendering operations, potentially gaining access to graphical memory and executing arbitrary commands through crafted WebGL content. Chrome users were urged to update to the latest version immediately, as the exploit was already being leveraged in targeted attacks.
Sources:
CyberSecureFox: https://cybersecurefox.com/en/chrome-zero-day-cve-2026-5281-webgpu-vulnerability/
HackWatch: https://hackwatch.io/alerts/actively-exploited-vulnerabilities-today
Adobe Reader Zero-Day CVE-2026-34621 Exploited via Malicious PDFs A critical zero-day vulnerability, CVE-2026-34621, in Adobe Reader is actively exploited through malicious PDFs, allowing attackers to execute code remotely. The vulnerability affects Adobe Reader and enables remote code execution when users open specially crafted PDF files. Adobe has released a patch, but organizations were urged to implement temporary mitigations and monitor for exploitation indicators. The vulnerability was verified across four independent sources, confirming its active exploitation status.
Sources:
HackWatch: https://hackwatch.io/alerts/actively-exploited-vulnerabilities-today
Wiz Blog: https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability

Incident Reports

DI VD Network Breached by Autonomous AI Agent Exploiting Zammad Zero-Days The Dutch Institute for Vulnerability Disclosure (DIVD) reported its network was breached by exploiting two Zammad zero-day vulnerabilities (CVE-2026-102489 and CVE-2026-102490). The attack was driven by an AI agent that moved autonomously, deciding its next steps without external intervention. The AI agent enabled session hijacking, remote code execution, and escalation to root privileges within seconds. DIVD retrieved extensive details because the AI agent left behind clear explanations of its decisions. Zammad is used by over 2,000 customers including Amnesty International and NextCloud. The nonprofit recommended upgrading to version 7 or taking instances offline.
Sources:
BleepingComputer: https://www.bleepingcomputer.com/news/security/divd-says-zammad-zero-days-enabled-ai-driven-network-breach/
HackWatch: https://hackwatch.io/alerts/actively-exploited-vulnerabilities-today
Vanderbilt University Hit in BYOD Ransomware Attack, Data Theft Claimed Vanderbilt University is restoring campus technology following a ransomware attack that targeted the institution’s bring-your-own-device (BYOD) environment. Hackers claim to have stolen student and employee data, though the university has not confirmed the attackers’ claims. The attack exploited the expansive personal device ecosystem across campus, where employees and students connect their own laptops, phones, and tablets to university networks. The incident highlights the growing risk posed by decentralized endpoints and the challenges of securing environments where the organization does not directly manage all devices.
Sources:
Malwarebytes: https://www.malwarebytes.com/blog/news/2026/11/a-week-in-security-november-2-november-8
HackWatch: https://hackwatch.io/alerts/actively-exploited-vulnerabilities-today
Revolve Card Breach: 1.5 Million People May Be Affected Online fashion retailer Revolve experienced a card breach potentially affecting 1.5 million people. The incident was identified during the week of November 2–8, 2026, as part of Malwarebytes’ weekly security roundup. The breach involved payment card data, though specific details about the attack vector and scope were still being refined at the time of reporting. The incident underscores the ongoing threat to e-commerce platforms and the volume of consumer financial data exposed in each successive breach cycle.
Sources:
Malwarebytes: https://www.malwarebytes.com/blog/news/2026/11/a-week-in-security-november-2-november-8
HackWatch: https://hackwatch.io/alerts/actively-exploited-vulnerabilities-today

Framework Changes

NIST SP 800-221r1 Opens for Public Comment Until December 7, 2026 The National Institute of Standards and Technology (NIST) opened a public comment period for Special Publication 800-221r1, an initial public draft focused on Enterprise Impact of Information and Communications Technology (ICT) Risk. The draft seeks input on how organizations should assess and manage the broader enterprise impact of ICT risks, extending beyond traditional cybersecurity boundaries. The comment period runs until December 7, 2026, giving organizations time to review the proposed framework and provide feedback before the final publication.
Sources:
NIST: https://www.nist.gov/cyberframework
TechTarget: https://www.techtarget.com/news/NIST-National-Institute-of-Standards-and-Technology/860705/
LinkedIn: https://www.linkedin.com/posts/tharun-kumar-68a74531b_this-program-has-been-invaluable-for-bridging-activity-7357337607590006784-JHnF
Australia Enacts Mandatory Cybersecurity Legislation for Smart Products Australia enacted mandatory cybersecurity legislation for smart products that came into force, principally similar to the UK’s Product Security and Transparency Act (PSTI) but with unique nuances. The law requires manufacturers of connected devices to meet defined security standards, including unique passwords, published vulnerability disclosure policies, and reasonable support periods for security updates. The legislation affects a broad range of consumer and enterprise smart products, from IoT devices to connected home appliances.
Sources:
LinkedIn (Catherine Phillips): https://www.linkedin.com/posts/catherine-phillips-60744119_cyber-security-security-standards-for-smart-activity-7434899110714998784-07Nt
The Register: https://www.theregister.com/public-sector/2026/11/11/australia-may-make-knowingly-selling-unsafe-ai-a-crime/5308999/
ISO/IEC 42001 AI Compliance Framework Gains Enterprise Adoption Organizations are increasingly preparing for ISO/IEC 42001 implementation, the first international standard for AI management systems. The standard provides a structured framework for AI governance, requiring phased implementation guidance that fits naturally into existing workflows. Companies are conducting AI code and model reviews, performing compliance assessments under the EU AI Act, and establishing documented decision records at every oversight checkpoint. The standard is gaining particular traction among enterprises using human-in-the-loop AI agents that require distinct oversight and accountability mechanisms.
Sources:
AI Compliance Center: https://ai-compliance.center/cases/283-2/
Dataiku: https://www.dataiku.com/blog/human-in-the-loop-ai-agents

New Legislation

Australia May Criminalize Knowingly Selling Unsafe AI Under New Bill Australia may make knowingly selling unsafe AI a crime under proposed legislation that requires companies to maintain and publish safety and security frameworks. The law would respond to updated standards and rules as technologies evolve, positioning Australia as a leader in AI regulation. The legislation requires organizations to demonstrate that their AI products meet defined safety thresholds before reaching consumers, with requirements for transparency, risk management, and ongoing compliance monitoring.
Sources:
The Register: https://www.theregister.com/public-sector/2026/11/11/australia-may-make-knowingly-selling-unsafe-ai-a-crime/5308999/
AI Compliance Center: https://ai-compliance.center/cases/283-2/
Trump Signs New Stablecoin Regulations Into Law President Trump signed new stablecoin regulations into law, establishing a comprehensive regulatory framework for stablecoin issuers and their reserve assets. The legislation requires full backing of stablecoin liabilities with high-quality liquid assets, regular audits, and transparent reporting of reserve compositions. The law also established a federal oversight mechanism for stablecoin issuers, creating new compliance requirements for digital asset companies operating in the United States.
Sources:
FOX8: https://fox8.com/news/1008883/
LinkedIn: https://www.linkedin.com/posts/catherine-phillips-60744119_cyber-security-security-standards-for-smart-activity-7434899110714998784-07Nt
Mandating Zero Trust Architecture as Condition of Cybersecurity Coverage A new model law proposes mandating Zero Trust Architecture (ZTA) as a condition of cybersecurity insurance coverage. By adopting a recognized ZTA model, organizations can more credibly demonstrate alignment with contemporary industry best practices and regulatory expectations. The model law aims to mitigate regulatory risk and strengthen civil litigation positions by requiring organizations to implement modern security architectures. The legislation reflects growing insurer pressure for organizations to adopt zero-trust principles as a baseline for coverage.
Sources:
Maine Law (SJIP): https://sjipl.mainelaw.edu/2026/05/11/mandating-zero-trust-architecture-as-a-condition-of-cybersecurity-coverage/
LinkedIn: https://www.linkedin.com/posts/tharun-kumar-68a74531b_this-program-has-been-invaluable-for-bridging-activity-7357337607590006784-JHnF