Fourteen items today after an interesting Friday the Thirteenth all over the US. A ransomware group wiped a victim’s entire virtualization estate without a single exploit. CVE disclosures passed 100,000 for the year. Four supply-chain breaches landed at once, all through somebody else’s systems. And the patch queue has a 9.8 that isn’t quite what the number suggests. Underneath all of it: read the flaw before you count it, inventory the estate before someone else administers it, and watch the vendors who hold your data.
The patch queue
Microsoft’s November Patch Tuesday included a CVSS 9.8 in SQL Server, CVE-2026-116945 — but the number needs the nuance, and the nuance changes the triage. It is a heap overflow in Integration Services, not the database engine. An attacker who controls a network endpoint that an SSIS package connects to can return a crafted response and get code execution in the integration service context. No SQL credentials, no user interaction, when the package runs automatically. It is not an unsolicited packet hitting a SQL listener. The exposure depends on where your SSIS packages reach out, which means the question isn’t whether SQL Server is internet-facing — it’s what your packages talk to. It was the top-scoring flaw in a 53-CVE SQL Server batch, 20 of them RCE. Not publicly disclosed, not exploited, not in CISA KEV yet. A 9.8 that isn’t a listener flaw is still a 9.8. The triage is different, and triage is where the time goes.
A second Fortinet critical deserves its own mention, because it is a different flaw in a different product, and conflating it with the week’s named flaw would be the easy mistake. CVE-2026-126261, advisory FG-IR-26-275, is an improper-authorization weakness in the FortiGate-to-FortiManager protocol. An unauthenticated attacker who can reach the FGFM port, TCP 541, can execute code or commands — and privileges are elevated before the device-registration password is even verified. Fortinet’s advisory shows 9.0; the vector computes to 9.8, which is what Fortinet filed with NVD. Fixed in 8.0.1, 7.6.8, 7.4.6, and 7.2.9, with no workaround listed. The design constraint is the point: FGFM has to be reachable from every managed FortiGate. Compromise the central manager and you hold the keys to the whole firewall estate. The manager is the estate, and the port is the door.
HPE patched 72 vulnerabilities in ArubaOS in one advisory, including eight scored CVSS 10.0. The one to know by name is CVE-2026-79895, an unauthenticated remote denial of service in AOS-10, scored 7.5. It’s a DoS, not an RCE, and it’s not in KEV. But a batch of 72 with eight 10.0s rewards a quick inventory check over a slow one — the batch is the headline, and the inventory is the work.
The estate, wiped
Kaspersky’s GERT team wrote up a BlackNevas intrusion that reads like a worst case, and the reason it reads that way is what the attackers didn’t need. Over ten days, they destroyed a victim’s entire virtualization estate — four ESXi hosts, every VM on them, both vCenter appliances, and all the connected backup infrastructure. No hypervisor exploit. No guest escape. Everything ran through legitimate VMware management interfaces, with stolen admin credentials taken from systems outside the virtualization stack, plus credentials extracted from the backup servers.
The signature move is the one I’d sit with. The attackers abused vCenter Host Profiles — a compliance feature — to push a config change switching SSH on across the ESXi hosts in about eleven minutes, then logged in directly from the trusted vCenter appliance itself. Persistence came through MeshAgent and a Ligolo-ng tunnel disguised as a VMware service. The wipe command stopped every VM within 23 seconds and overwrote the first 2 KB of each virtual disk, destroying the MBR and the primary GPT header. Backups were stopped and antivirus disabled days ahead. The victim was running unsupported ESXi versions.
The temptation is to file this under ransomware and move on, but the lesson is narrower. The hypervisor wasn’t hacked. It was administered — by the wrong admin. The credentials came from outside the virtualization stack, the management interfaces were legitimate, and the compliance feature did exactly what it was built to do. The exposure wasn’t a vulnerability in the hypervisor. It was the credential hygiene of everything around it, and the management plane being reachable with those credentials. That is a different problem than a patch, and it doesn’t have a patch-shaped answer.
The typo is the attack
Island researchers counted 186 lookalike domains across 27 AI brands — Claude, ChatGPT, Gemini, Copilot, Grok, DeepSeek, and more. ChatGPT has the most, 25. Some domains were registered as early as July 2023. They call the campaign TypoPrompting, and the typos lead three places, which is what makes it worth reading as a campaign rather than a count.
A Claude typo leads to a fake Cloudflare verification page telling the user to run a PowerShell command — classic ClickFix, with the payload host hidden as a decimal-encoded IP to evade filters. Eight typos lead to fake security-check pages delivering Net Guard, a Microsoft Store-signed browser hijacker that can change the default search engine while the user is idle and run remotely supplied JavaScript. And a Perplexity typo funnels users to a Chrome Web Store extension that silently overrides the default search provider — one of 30 extensions from the same kit, 17 still listed, with 972,000 declared users. The gate behind the ClickFix route serves 211 entry domains, including banks, insurers, and enterprise software.
The Store-signed app is the detail that stays with me: a signed app from the official store, acting as a hijacker, with a hash that matches the listing. The trust signal and the malware are the same object. And the typo is the phishing email now — the brand is the lure, and the user’s own fingers do the targeting.
Attribution and sabotage
France formally attributed the supermarket refrigeration attacks on November 9 — the Foreign Ministry, a CERT-FR technical notice, and the Paris prosecutor together. The attribution names Shahid Kaveh and Shahid Shoostari, elite offensive cyber units of Iran’s IRGC, linked to hacktivist fronts including CyberAveng3rs. The evidence: Iran-linked IP addresses, Farsi words in attacker traces, and tactics consistent with prior Shahid Kaveh campaigns.
About 700 supermarket sites were hit overnight on October 11 and 12. Attackers started unlimited defrost cycles and disabled high-temperature alarms, pushing cabinets to 50 degrees Celsius. At least 15 fires — the prosecutor’s office puts it near 20. Food losses in the tens of millions of euros. The prosecutor has requested international arrest warrants for three named IRGC leaders, and France summoned Iran’s ambassador. France calls it the first cyber-offensive campaign carried out purely for sabotage on French territory.
I covered the attacks last week, when they were a second wave of refrigeration controllers being hit. The attribution is the new element, and it matters beyond the headlines. A rare single-country attribution, naming names and requesting warrants, is a precedent — and the objective, pure sabotage, is the part that changes the threat model. These weren’t espionage or extortion. The food spoiled on the shelves. The fridge was the target, and the attribution is the precedent.
The third party is the breach
Four breaches today, and all four ran through somebody else’s systems. That is the thread.
Uber disclosed that drivers’ license data was stolen through a third-party provider — and the provider, confirmed by an Uber spokesperson, was Fireworks AI. The state filings put the confirmed count at 7,870 people across three states: Massachusetts, South Carolina, Rhode Island. California and Illinois counts weren’t disclosed, and there’s no nationwide total yet. The provider told Uber on October 9 that its internal credentials were compromised. Uber severed the data connections. On October 13, the investigation confirmed Uber data had been accessed. Uber’s own systems were not breached, and Uber says it has found no misuse of the data to date. The breach is the vendor’s. The notification is Uber’s. The vendor held the keys, and the drivers hold the risk.
The extortion group n0n claims it stole 830 million loyalty rows, 58 million traveler profiles, and 333.3 million consumer account records from Expedia, plus live credentials for the big-data platform and access to nearly 20,000 private repositories. None of that is independently verified — it is the attackers’ claim, and it should be read as one. What is confirmed: Expedia told Skift on November 12 that attackers compromised a third-party data platform provider and used its trusted access to reach systems at multiple companies, including Expedia Group. A supply-chain attack, contained, platforms safe to use. The vendor is unnamed, the data taken is undisclosed, and no SEC Form 8-K had been filed as of November 13. The group emerged in September and listed Expedia on its leak site on November 3. A sample has been published, and date ranges in some files suggest at least part of the material is historical. The claim is the headline. The confirmed part is the trusted third party.
The City of Osaka confirmed on November 13 that 1,078,713 email addresses leaked from its administrative online system. The number is precise, and it’s addresses, not people — anyone who received an email from the system between July 1 and October 31 is affected, and the count is high partly because the city emailed every registered user on September 16. The breach ran through Arara, the email distribution service used by TKC, the vendor that runs the platform. Arara’s own November 2 breach exposed about 77 million addresses from nearly 400 customers, including Sega, and attackers used the service to send millions of phishing emails impersonating card companies and banks. Japan has now seen about 380 million pieces of personal data stolen in 2026, with October accounting for 58% of the year’s reported incidents. The vendor’s breach is the city’s breach, and the email address is the exposure.
Autopay, the Polish payment operator formerly known as Blue Media, confirmed on November 13 that it detected unauthorized access to its infrastructure and part of the payment data it processed on November 11. It hasn’t confirmed data was copied, but says it can’t completely rule it out, and it’s notifying affected customers directly. The company’s security manager says the attack was highly automated, most likely using a large language model, and the methods were shared with the financial sector’s incident response team. Customer funds are safe, per the company. The payment processor is the target, and the LLM is the automation.
Four breaches, one pattern. The vendor holds the data, the vendor’s credentials are the path in, and the notification lands on someone else’s desk. The third-party risk conversation is usually about questionnaires and attestations. Today it’s about drivers’ licenses, loyalty records, a million email addresses, and payment data — and how little of it was in the breached company’s own systems.
The long horizon
NASCIO’s new report tells US states to start post-quantum migration now, even though a cryptographically relevant quantum computer doesn’t exist yet. The argument is the timeline: large organizations could need 4 to 15 years to migrate their largest systems, and a GAO report says most experts expect a quantum computer capable of breaking many public-key methods by the early 2030s. The readiness gap is wide: 73% of state CIOs said their states were monitoring quantum developments but had taken no formal action. Fourteen percent have an initiative underway, 6% have funding, 2% have a policy or strategy. And the threat is already live in the other direction — harvest now, decrypt later. Adversaries can collect encrypted state data today and decrypt it when the machine arrives. The quantum computer isn’t here. The encrypted data already is.
CVE disclosures in 2026 passed 100,000 on Friday, November 13. VulnCheck counted 100,222 by about 4 PM UTC — more than double 2025’s total. FIRST had predicted in February that the year could plausibly reach 100,000 at the upper bound. The actual count has blown past it, with weeks left. VulnCheck’s Josh Bressers puts it plainly: vulnerability hunting with AI is driving a majority of what we’re seeing. Microsoft alone added 1,094 flaws on Patch Tuesday, after 1,474 the month before. Anthropic’s Project Glasswing found at least 129,000 verified vulnerabilities between April and July. curl’s maintainer shut its bug bounty in October, citing an avalanche of AI-generated reports. Only about 1.4% of 2026 CVEs are in the KEV catalog. But the median time from publication to exploitation fell from 120 days to 80, and CrowdStrike found 88% of exploitation using public proof-of-concept code happened within 48 hours of release. Bressers again: we don’t have a security problem anymore. We have a data problem now. The count is the milestone. The 48 hours is the deadline.
Proofpoint’s 2026 Europe threat landscape, announced at Web Summit, has a number that stops you: phishing detections rose 4.5 times year over year across Europe, against 1.5 times globally. Roughly three times faster. The UK saw a six-fold jump. European users are also far more likely to engage — 8.3 clicks for every 100 delivered threat messages, against 2.0 worldwide. And precision cloud attacks are landing: 64% of European organizations targeted by precision attacks showed evidence of impact, against 33% for brute-force. Attacks targeting open-source AI technologies like Langflow and LiteLLM rose 4.6 times between consecutive 90-day periods, and Proofpoint counted more than 188,000 AI-enabled applications connected through authentication frameworks. The phishing is faster in Europe. The clicking is faster too.
And the FAA issued a nationwide ground stop on Friday, November 13, after a communications problem hit its air route traffic control centers. Lifted after more than four hours, about 7,000 flights delayed or cancelled. The Homeland Security Secretary said it did not appear to be a cyberattack — no chatter, no footprints — while stopping short of ruling it out entirely. The FBI is examining whether a software update was responsible. The network, operated by L3Harris, rebooted and crashed after an update. No official root cause yet, and officials say it’s not connected to the Microsoft outage earlier in the week. A ground stop with no cyberattack is still a ground stop, and the legacy equipment is the story.
The long horizon is the thread that ties the day together. The quantum migration that hasn’t started, the vulnerability count that doubled, the phishing that tripled in Europe, the air traffic system that stopped without an attacker. None of these is a single incident to respond to — they are the conditions the incidents happen in.
The day’s shape, then: patch the queue, and read the flaw before you count it. Inventory the estate, because the management plane is the attack surface. Watch the vendors, because the breach runs through their credentials. And keep the long horizon in view: the count, the clicking, and the migration gap are all moving the same direction — up.
Leave a Reply