Top news stories this week
- Cloud burst. Microsoft outage takes down Office 365 suite services worldwide.
- UN-able. MSPs face new supply-chain risks via N-able and ScreenConnect tools.
- Switching on oversight. Australia plans AI regulation and OpenAI builds a kill switch.
- Karma strikes back. The leader of ransom gang Qilin identified using leaked data.
- AI-stin Powers. AI agents power attacks in multiple incidents.
- Chilling effect. France accuses Iran of supermarket fridge cyberattack.
- Flawed. Security flaws leave UK government vulnerable.
- Patch me if you can. Active exploitation adds urgency to busy November patch cycle. .
1. Microsoft outage takes down Office 365 suite services worldwide
A significant outage has disrupted Microsoft 365 services worldwide, impacting Exchange Online, Teams, Copilot 365, and Defender for Office 365. Microsoft ruled out a cyberattack, tracing the cause to an unexpected loss of server capacity. The knock-on disruption is impacting OpenAI and Anthropic services. While Microsoft has reported some stabilisation, capacity has not yet returned to normal levels.
So what?
The incident highlights the criticality of email infrastructure for majority of services across businesses and governmental services worldwide, underscoring the risk of concentrating productivity tooling with a single cloud vendor.
[Researcher: Milda Petraityte]
2. MSPs face new supply-chain risks via N-able and ScreenConnect tools
N-able took its hosted N-central remote monitoring and management (RMM) platform offline and instructed on-premises customers to shut down their servers after public disclosure of over 30 zero-day vulnerabilities created an immediate risk for organisations and managed services providers (MSPs) using the platform.
Separately, attackers are actively exploiting compromised ConnectWise ScreenConnect accounts to push rogue remote-access tools onto MSP customer devices. ConnectWise warns that even opening a support session with an infected device could compromise a technician's own workstation.
So what?
MSPs and organisational cybersecurity teams should treat vulnerabilities in remote management platforms as potential compromises across their entire customer environment, rather than isolated software issues. Practitioners should patch immediately, restrict external access, and investigate for unauthorised accounts and activity.
[Researcher: Steve Ross]
3. Australia plans AI regulation and OpenAI builds a kill switch
The Australian government intends to establish a dedicated AI safety regulator compelling AI companies to report breaches and misaligned behaviour. The regulator would oversee the development and use of AI systems, conduct independent evaluations of models, and impose penalties for compliance failures.
Separately, OpenAI has introduced “Control Room”, a central kill switch that stops model output within 35 seconds of a decision to intervene. It follows one of its research models escaping internet restrictions in a sandbox and running for over two hours before it was manually shut down.
So what?
Australia’s response will be watched closely by other countries planning to regulate AI and could make rapid incident disclosure standard practice for AI developers.
[Researcher: Robin Toulalan Parr]
4. The leader of ransom gang Qilin identified using leaked data
The leader of Qilin, a globally active ransomware gang, has been traced by researchers by cross-referencing data from hacked cybercrime forums, leaked records from services platform Gosuslugi, and breached travel records. The identified Russian national’s digital footprint shows a progression from small-time fraud from 2018 to organising complex ransomware operations.
SO WHAT?
The identification of ransomware gang members enables law enforcement to impose sanctions against them, which deters victims from paying the ransom. This could disrupt the operation, potentially forcing it to regroup and rebrand under a new name, although the full extent of this attribution remains to be seen. You can read more about Qilin and its operations in article Ransomware in focus: Meet Qilin.
[Researcher: Milda Petraityte]
5. AI agents power attacks in multiple incidents
Over 2,000 exposed credentials have been identified across public GitHub repositories linked to AI coding workflows, including some inadvertently written to Claude Code configuration files. Separately, a German web host was exploited through a flaw in its Model Context Protocol (MCP) server, which connects AI assistants to its hosting platform, resulting in the compromise of 56 customer projects.
Additionally, attackers breached a cloud hosting provider gaining access to credentials used to decrypt customer environment variables. The provider said the attackers used AI-powered agents to probe multiple attack paths in parallel, while stolen AI-provider credentials were subsequently used to generate approximately US 740,000 in unauthorised AI usage.
So What?
AI agents are increasingly operating with the permissions and contextual access needed to interact directly with source code, credentials and production infrastructure. Insecure integrations, exposed secrets and excessive permissions can introduce new risks. Organisations adopting agentic tools should extend established security controls, including least privilege, secrets management, code review and monitoring.
[Researcher: Gabriella Nolan]
6. Chilling effect: France accuses Iran of supermarket fridge cyberattack
France has accused a cyber unit affiliated with Iran’s armed forces of carrying out the cyberattacks on internet-connected refrigeration systems last month, causing fridges and freezers to heat up and food to spoil. French officials described the incident as the country’s first large-scale cyberattack aimed at sabotage. Iranian officials have denied responsibility.
SO WHAT?
The attack highlights the importance of securing internet-connected operational technology (OT). The European Union Agency for Cybersecurity (ENISA) similarly identifies legacy technology and supply-chain risks as continuing challenges to critical infrastructure resilience across the EU.
[Researcher: Asya Sonnichsen]
7. Security flaws leave UK government vulnerable
Several serious vulnerabilities in publicly available UK government code have been uncovered The weaknesses affect multiple government organisations and largely involve basic security hygiene failures rather than sophisticated exploitation techniques. Issues included exposed credentials, inadequate access controls, overly privileged service accounts, and insecure defaults.
SO WHAT?
Exposed vulnerabilities lower the barrier to exploitation, particularly as AI-powered tools increasingly enable attackers to identify and assess weaknesses faster and at scale.
[Researcher: Tlhalefo Dikolomela]
8. Active exploitation adds urgency to busy November patch cycle
November has seen a broad range of security updates across enterprise technologies. Microsoft’s November 2026 Patch Tuesday included fixes for 1,235 vulnerabilities, with an Outlook weakness already observed in attacks targeting authentication data. However, it also added that this month's Patch Tuesday security updates are causing Windows activation and licensing failures.
Separately, SAP’s November security updates addressed four critical weaknesses across core SAP components that could allow compromise without valid credentials. Similarly, Barracuda has also reported limited exploitation of recently patched Email Security Gateway vulnerabilities capable of providing attackers with elevated control of affected appliances.
SO WHAT?
High patch volumes can obscure the vulnerabilities that matter most. Known exploitation, external accessibility and potential impact provide a more useful basis to organisations for prioritizing remediation.
[Researcher: Jenny Eysert]
The information contained herein is intended for informational purposes only. Insurance coverage in any particular case will depend upon the type of policy in effect, the terms, conditions and exclusions in any such policy, and the facts of each unique situation. No representation is made that any specific insurance coverage would apply in the circumstances outlined herein. Please refer to the individual policy forms for specific coverage details. S-RM does not assume, and shall have no liability for the control, correction, continuation or modification of any existing conditions or situation.
