Well… .Maybe not as this was a “backhoe day” for many. And business globally ground to a halt for a day and a half. Having said that, Microsoft has said this:
We are deeply sorry for the disruption this incident has caused our customers and partners. We know the trust they place in our services and take that responsibility extremely seriously. We are seeing broad recovery and stability across our services.
A couple of things. I am seeing things acting “sort of normal” from about 2PM EST. I also sense that this is more of a “please don’t leave us for Goggle Workspace” than a legitimate apology. But maybe I am looking at this from a cynical point of view. Also, you may note that things may still be problematic. But at least they seem to be headed in the right direction.
Finally, Microsoft says that this wasn’t AI (as I am guessing that they don’t want to curtail sales of CoPilot) or a threat actor at work. Basically, Microsoft screwed up. That alone will make reading the root cause analysis interesting.
The cyberattacks targeting commercial refrigeration systems aren’t going away. What began with attacks in France in October has since expanded to incidents in other regions, raising bigger questions about the security of connected equipment. And one of the most alarming details? According to French prosecutors, attackers weren’t just manipulating temperatures, they were also disabling the safety alerts designed to warn operators something was wrong.
Matt Wyckhouse, CEO of connected product security company Finite State, says these attacks expose a much bigger problem: what happens when hackers can compromise both physical equipment and the safeguards meant to protect it?
On Iran and what made the attack dangerous “We used to joke about putting your refrigerator on the internet. But a grocer has a good reason to know at two in the morning that a freezer is warming up. France attributed the October attacks to a cyber unit of Iran’s Revolutionary Guard, and French prosecutors say the attackers disabled safety alerts as well. If the same system can change the temperature and silence the warning, what protection is actually left? That’s a question for the people who design the controller as much as it is for the people who run the store.”
On why a patch isn’t the finish line “Embedded patching is hard and much slower than what we see in web apps. I’ve seen small security fixes have unintended consequences. One patch accidentally changed how much power a chip drew and shut off a camera sensor while it was recording. The manufacturer caught it before it shipped. That’s the reality of fixing software that controls physical equipment: you have to close the security hole and prove the equipment still does its job. I’d ask how long it took to protect the last freezer, not how fast the vendor posted a patch.”
On what AI changes “A refrigeration controller can still be running perfectly years after the manufacturer stops supporting it. AI is bringing down the time and expertise it takes to find flaws in that old firmware. I haven’t seen public evidence that AI was used in the French attacks, but I wouldn’t wait for that proof to act. Manufacturers can use the same tools to find problems in equipment they’ve already shipped and give operators time to decide what they can safely update, what they need to isolate, and what they need to replace. You want to make those decisions on a maintenance schedule, not at two in the morning with a freezer warming up.”
The Kazakhstan-linked cyber espionage operation targeting Tajikistan is raising some interesting questions about just how much of the hacking process criminals can now hand off to AI agents, and how easily those operations can hide in plain sight. Don’t know what I am talking about? This might help: Kazakhstan-linked hackers used AI to steal Tajik government documents, researchers say
“Attackers have been using public platforms to send instructions to malware for years. We’ve seen research on everything from Google searches and Twitter posts to images on discussion boards. It was only a matter of time before someone applied the same idea to AI agents.
“What worries me is giving agents the ability to act on the open internet with very little oversight, especially when they take instructions from public content that other people can manipulate. The parallel I see with biological weapons is the problem of containment. Once you release something you can’t reliably control, you can’t count on the effects stopping with the people you intended to target. I wish more people would think twice before deploying agents this way.”
“AI didn’t initiate this hack. Human attackers did, and once inside, they put an AI agent to work doing the dirty work hackers normally do themselves. The initial entry point may well have been a phishing email, possibly generated by AI, although that hasn’t been confirmed.
“What we do know is that once again, identity was the front door, with a compromised railway employee account providing access to sensitive government documents. That initial credential compromise could have been prevented with dedicated biometric authentication devices requiring a fingerprint, physical proximity and cryptographic verification, rather than passwords and easily phished legacy MFA or phone authenticated passkeys. Once inside, the attackers unleashed an AI agent to perform reconnaissance, write code, collect thousands of documents and help cover their tracks. And controlling that agent remotely through Telegram was brilliant in its simplicity, effectively putting a powerful hacking operation in the attacker’s pocket.
“The interesting part is that one hacker can now direct work that previously required a skilled team, potentially operating 24 hours a day. The lesson for CISOs is that AI has dramatically accelerated what attackers can accomplish AFTER gaining access, making it more important than ever to secure identity at the front door.
“It remains perplexing that enterprises spend millions hoping to detect AI powered hackers already inside their networks when they could spend far less preventing credential based intrusions at the front door.”
“The most consequential part of this story is how much work the attacker could delegate between check-ins. Remote control through messaging services has a long history. ESET documented Telegram-based malware command and control in 2016. Telegram gives the operator a convenient interface; the agent adds the ability to interpret instructions and carry out work toward an objective. ESET research CloudSEK says the agent handled reconnaissance, collection, and log cleanup. That puts AI inside the operational workflow, beyond simply drafting a phishing email or suggesting a script.
“The broader concern is the economics of attacker attention. Human operators have limited time to examine results, decide what comes next and manage repetitive collection. An agent that can take on portions of that workload could allow an experienced attacker to supervise more activity. The human remains the commander, while the software handles more of the execution. We should be precise about the evidence, though. Delegating operational tasks does not, by itself, demonstrate that an agent independently selected targets, discovered new vulnerabilities or completed an entire intrusion without supervision. This case provides evidence of meaningful delegation; the exact degree of autonomy still matters.
“For organizations, I would turn that concern into a practical question: ‘If an attacker takes over one ordinary employee account and delegates the follow-on work to an agent, how far can that account reach before we stop it?’ That means testing document and attachment permissions, limiting access between systems, and watching for unusual breadth of searches and downloads; even when the account successfully authenticates. Authorization needs to be checked for each requested record, as OWASP recommends.
“Security teams should also rehearse how quickly they can revoke sessions, isolate affected systems, and interrupt collection. Those exercises should include an adversary that continues working between human check-ins. Finally, the exposed attacker server is a useful reminder that AI does not eliminate human mistakes.
“Apparently, delegating the espionage still leaves someone responsible for locking the filing cabinet. The question defenders should measure is how much damage a compromised identity can do before their controls intervene. Agent-assisted operations make that an increasingly urgent test.”
“CloudSEK got lucky, and so did everyone reading this. The Singapore firm found the Silent Lynx operation because the operator leaked his own server, a dozen-plus gigabytes holding stolen Tajik documents, hacking tools, and a log of how he ran an AI agent named Hermes. He spoke to it in Russian from his phone, through a Telegram bot, while the agent ran on DeepSeek models and did his reconnaissance, collected his files, and cleaned up behind him.
“The instructive part sits in that log. The operator never typed hacking commands by hand. The command channel for an espionage campaign against a national railway was a chat app on a phone, indistinguishable in network logs from ordinary messaging.
“This is the second time this year the channel has mattered more than the model. In the spring, agents inside OpenAI turned DseWiki, a 25-year-old German-language wiki with about ten edits in the prior two decades, into their private message board and coordinated there for weeks before anyone at the lab noticed. One case is a spy choosing cover, the other is agents finding it on their own. The lesson lands the same way, the traffic to watch lives in the boring platforms, and almost no security operations center writes detections for command-and-control that looks like a notification.
“Tajikistan shows the payoff. Access to the national railway held from mid-August into early October, one railway employee’s credentials opened the national document management system, and more than 2,000 files came out, including Defense Ministry correspondence on flight clearances and personnel transfers. The agent arrived pre-authorized to run destructive commands with no approval step, which is exactly the gate nobody should ever remove.
“The Kazakhstan label deserves a raised eyebrow. CloudSEK itself rates it medium confidence on Russian-language records and one residential internet connection, and this group’s earlier campaigns ran on hijacked official email accounts, a reminder that infrastructure in operations like this rarely belongs to whoever benefits. I read the attribution as a lead, nothing firmer.”
Yet again this is another case where people should read the details and close the holes that they have in their organization. The question is will anyone do the required reading?
I have two Microsoft Outlook test accounts with two sign in methods on my phone and on my MacBook Pro. Both have not received emails since this outage started. Thus I was playing with them to see if I could figure out how to get back online.
I started with logging into one of the accounts via the web. I was able to see email from there. That was interesting because on my iPhone, I was not able to see any email. And it would throw an error about not being able to see the mailbox. Thus on my iPhone I went to the Mail app and then Accounts. Upon going there, I was being asked to log in again. So I did.
That worked.
Thus I tried it with the second Microsoft Outlook account which was in a similar state. I was able to repeat this. So this clearly is a thing. While I am currently not at home, it would not surprise me if anything that runs MacOS is fixed in the same manner.
Thus I turn it over to you. Have you fixed Outlook or Exchange via the Mail app on iOS or MacOS in this manner? Please leave a comment and let me and others know as I think we all could benefit from this.
Posted in Commentary with tags Netgear on November 13, 2026 by itnerd
NETGEAR, Inc. today announced two leadership appointments as it expands its investment in multifamily managed WiFi market. Azif Abdul Salam joins as Senior Director, Solutions Architecture, and Yancey Johnson joins as Vertical Account Director, strengthening NETGEAR Enterprise’s technical and commercial support for managed service providers (MSPs) serving apartment owners and operators.
Reliable, property-wide WiFi is an increasingly important amenity for renters and an operational priority for property owners. Yet only 5% to 7% of U.S. rental communities offer it today, while 81% of renters say they want it, according to research from Maravedis. Delivering it requires networks that provide private resident connectivity and can be deployed and managed efficiently across entire property portfolios.
MSPs play a central role in designing, deploying and operating these networks for property owners. They need technology that scales across properties, predictable costs per apartment and a vendor committed to supporting their business over time.
NETGEAR Enterprise’s multifamily networking portfolio includes multifamily network: WiFi 7 and WiFi 6 access points, WiFi 6 in-unit wall plates, multi-gig PoE switches and gateways, all managed from NETGEAR’s single-pane-of-glass management platform designed for the MDU market. Each apartment needs its own private network, and the platform gives every unit a separate one through multi-PSK and VLAN segmentation, so residents get the privacy of a home connection.
NETGEAR’s platform was built for MSPs. One account holds every customer property, new sites onboard in bulk with zero-touch provisioning, and licenses move between properties. If the platform is ever unreachable, the network keeps running and every device can still be managed locally, so residents stay online.
Azif Abdul Salam has more than 24 years of experience in wireless and wired networking. He held pre-sales and post-sales roles at Symbol, Motorola and Zebra, built the solutions quality assurance team at Ruckus Wireless, and led Solutions Engineering for North America at Cambium Networks, where he developed the company’s MDU capabilities.
Yancey Johnson spent 14 years as Regional Sales Manager, Southeast, at Cambium Networks. Before Cambium, he worked at wireless vendors Radwin and Firetide. At NETGEAR, he will lead account development and relationships with MSPs serving the multifamily market.
The only tech story going right now other than Jenson Huang who used to be with Nvidia is the great Microsoft outage as I am calling it. So many organizations use Microsoft products, there’s a very good chance that a lot of organizations are affected.
Here’s what we know at 8:30 AM EST:
A huge range of Microsoft 365 products were down. That includes Exchange email (which includes Outlook.com and Hotmail), Microsoft Outlook, Teams and Copilot.
There are also reports of Planner, To Do, administrative tools such as InTune, and some SharePoint functions being affected.
Microsoft has had problems brining things online. But as of an hour ago, Microsoft said this:
We’ve made additional progress toward recovery, with actions now completed across portions of affected infrastructure and traffic being gradually restored. We’re seeing improvements in key scenarios, including mailbox access and delayed email processing, though some intermittent…
I have personally heard that personal email such as outlook.com is still not working. But corporate email seems to be starting to come back online. That I suppose is progress. But you should bet on Microsoft tools of any sort not being back to normal today. So you should structure your business accordingly.
Also of note:
Microsoft has increased the email timeout window to 48 hours to help protect delayed messages while backlogs clear. So that suggests to me that normal service may not return until the end of the weekend.
There has been no malicious activity that Microsoft admits to.
That does raise a few questions. Everybody and their dog it seems uses a Microsoft product to conduct business. Seeing as we’re stretching into a business day with no resolution of this issue, will organizations reconsider their use of Microsoft products because of this? And what will Microsoft do to placate all these angry organizations?
I guess we’re about to find out.
UPDATE: Mario de Cicco, VP, European Financial Institutions, Morningstar DBRS said this on the great Microsoft outage:
“The Microsoft outage could result in a number of insurance claims, mostly related to businesses experiencing financial losses, operational disruptions, and delays in serving customers. However, not all businesses will automatically be entitled to compensation, as this depends on the terms and conditions of their insurance policies. Some cyber insurance policies only cover losses caused by malicious cyberattacks, whereas the Microsoft outage appears to have resulted from a technical failure rather than a deliberate attack. Additionally, some policies include waiting periods before business interruption cover becomes effective.
The 2024 CrowdStrike outage is a useful comparison. The issue was caused by a faulty software update that affected around 8.5 million Windows devices worldwide. It disrupted major industries, including airlines, hospitals, banks, and retailers, and caused flight cancellations, business interruptions, financial losses, and delays in services that generated insurance claims. The CrowdStrike had a significant global impact—according to CyberCube, it generated insurance losses between USD 400 million and USD 1.5 billion. Although currently less severe, if the Microsoft outage continues for several days, it could become equally serious or potentially worse.
Both outages highlight the credit and operational risks that insurance companies face from their growing reliance on concentrated technology providers and server infrastructures, the consequences of which are difficult to predict. The ultimate impact on claims will be determined by the scope of policy coverage, and insurers’ responses will depend on the waiting period, deductibles, sublimits, and exclusions. Economic losses outside of policy terms and conditions will be borne by businesses.
In our view, the overall credit impact of the Microsoft outage on insurers is likely to be limited, with global insured losses estimates at USD 300 million to USD 500 million, well below the CrowdStrike outage estimates. This reflects the potentially limited coverage under existing cyber policies and exclusions for nonmalicious tech failures. However, this remains a preliminary estimate given the ongoing nature of the outage and the uncertainty surrounding its ultimate duration and overall impact.”
UPDATE x2: More commentary has flooded my inbox as I am not on Microsoft infrastructure:
The risk now to watch for is scammers: ignore any message asking you to sign in to “restore” your account.
This outage shows how much now runs on one system. Microsoft said the features that failed were the ones that depend on Exchange Online, its email and calendar service. That included Teams scheduling and Copilot. It also included Microsoft’s own security tools, Defender and Purview. So the outage did not only stop work. It also reached tools that security teams rely on, while fake “restore your Outlook account” messages were being reported.
Microsoft has not confirmed the root cause. Its updates describe servers dropping out, the rest overloading, and automated health checks that may have wrongly marked servers as failed. Automation built to protect a system can deepen an outage.
The lesson for organizations is to know what depends on what. Ask which tools, including security tools, stop when your email provider does. Keep one way to reach your team that does not run through that provider.
In short, when email, calendars, AI assistants and even security tools depend on one system, one failure reaches all of them. From what Microsoft has said so far, mail is delayed, not lost, so it’s important to ignore any message to “restore” email accounts.
“The Microsoft outage underscores how interconnected enterprise technology has become. Outlook, Teams and Copilot may appear to be separate products, but they rely on shared infrastructure. When a critical component responsible for connections or traffic routing fails, disruption can spread quickly across services and affect millions of users.
“Microsoft’s root-cause analysis should explain what triggered the failure, why it propagated so widely and why safeguards failed to contain it. If a software or configuration change was involved, customers need to know how it was validated before reaching production and what controls will prevent a recurrence.
“This is especially important as AI agents take on more responsibility for testing, deployment and production changes. Because these systems can behave unpredictably, enterprises need deterministic controls that validate changes, enforce policies and require approvals, regardless of whether a change originates with a developer, an automated pipeline or an AI agent.
“There’s no indication that the outage itself means emails or data were compromised. Still, users should verify that time-sensitive messages sent during the disruption were delivered. The larger take-away: organizations have got to continually examine how dependent their operations are on interconnected platforms and whether they can maintain critical functions when one of those platforms fails.”
“Outages like this are a reminder that availability and recoverability are two different things. A service can be down for hours without any data being lost, and that’s the likely outcome for most people here. But organizations shouldn’t wait for an event like this to find out which of those two situations they’re in.
“The real lesson is about continuity planning. Most companies have concentrated email, collaboration, and now AI assistants with a single provider. That makes sense for efficiency, but it means a single disruption can stop work across the whole business at once. Resilient organizations know which systems and data they can’t operate without and have a plan for how people communicate and work when a primary platform is unavailable. They also regularly test that their recovery actually works, rather than assuming it will.
“As services come back, IT teams should do more than confirm things are running again. They should verify that mail flow, files, and permissions are complete and correct. They should watch for phishing that impersonates ‘outage recovery’ notices. And they should use the incident to pressure-test their own continuity plans.”
“This was likely not a cyberattack, but something far more mundane and potentially more troubling: an internal software update or infrastructure change with a bug that wasn’t caught before deployment. While Microsoft is still investigating, the cascading failures suggest that when one part of a massive cloud service goes down, the remaining infrastructure can quickly become overwhelmed.
“The bigger issue is that we’ve allowed much of society to become dependent on a handful of cloud providers. With more than 300 million people relying on Outlook alone, even a relatively small software mistake can potentially disrupt businesses and individuals around the world. And perhaps most remarkably, three decades after email was introduced, we still depend on it for nearly everything. We’ve built an incredibly interconnected digital world, but that interconnectedness also means a single failure can have enormous consequences.”
“What stands out from our monitoring is how quickly this moved from an isolated failure into a global service degradation.
APIContext continuously executes real synthetic transactions against Microsoft services from monitoring agents around the world, so we can see whether the underlying servers and applications are actually working rather than relying on user reports. We had a clean baseline through 16:59 GMT, saw the first Exchange-backed failure at 17:29, and by 19:00 around 90% of our checks were failing.
Within roughly 36 minutes, we were seeing failures across North America, Europe, Asia, Oceania and South America. Overnight the failure rate reached almost 96%, and even this morning it remained above 80%.
What is particularly interesting is that not everything failed. Our profile, OneDrive and authentication continued to work, while Exchange-backed Microsoft Graph workloads deteriorated globally. That helps isolate this as a dependency problem rather than a complete Microsoft cloud failure.
This is why modern outages are so difficult to understand from inside one application. Organisations tend to monitor the systems they own, but customer transactions depend on chains of internal and external services. Those dependencies often only become visible when one of them fails.
Complexity comes from the dependencies between systems, not simply the number of systems themselves. In this case, one degraded service has had a much wider operational impact because so many applications and workflows depend on it.”
Our monitoring recorded (see below image):
A clean baseline through 16:59 GMT on 12 November, with 55 successful checks and no failures.
The first failure at 17:29:40 GMT from Toronto, where a mailFolders check returned an HTTP 504 after 30 seconds.
A failure rate of 23% during the 17:00 hour.
A failure rate of 69% during the 18:00 hour.
A failure rate of 90% by 19:00.
An overnight peak of 95.8% failure between 02:00 and 02:59 GMT. 335 failures across 115 monitoring locations in 19 countries and all six monitored continents.
Failures appearing across North America, Europe, Asia, Oceania and South America within roughly 36 minutes of the first observed failure.
The UK agent first failing at 18:16 GMT.
Failure rates still running at approximately 83% during 06:00-07:59 GMT on 13 November.
A failure recorded as recently as 07:52:37 GMT from Korea South.”
United Airlines has announced that it is restricting unauthorized third-party AI agents from booking flights and managing customer reservations, citing concerns about data security, account access and unintended transactions.
The November 11 decision comes as AI assistants become increasingly capable of making purchases and completing tasks on behalf of consumers.
United warned that sharing account credentials with AI agents could expose sensitive personal information and lead to unauthorized purchases, account modifications or the use of MileagePlus miles.
The airline also raised regulatory concerns, noting that automated check-ins could bypass FAA and DOT requirements for passengers to personally acknowledge that their baggage does not contain prohibited items.
“I think United has two concerns here, and only one is being discussed publicly. The first is commercial. AI agents will become exceptionally good at finding the lowest fares, comparing every possible alternative, and making purchasing decisions entirely in the customer’s interest. Airlines have spent decades optimizing pricing, merchandising, and upselling. An intelligent agent working exclusively for the traveler will disrupt that model considerably.
“The second concern is legitimate liability. What happens when an agent books the wrong flight, spends someone’s MileagePlus miles, or purchases a ticket the customer insists they never authorized? Who pays when the customer disputes the charge? These are real issues, as are security and regulatory compliance. But they are solvable through verified identity, explicit customer authorization for financial transactions, spending limits, and auditable consent.
“Ultimately, I believe United will lose this battle. AI agents will increasingly act on our behalf, just as executive assistants have done for decades. We don’t prohibit executive assistants from booking flights because they might make mistakes. We establish authorization and accountability. The same will happen with AI agents. United’s decision may make sense today, but five years from now, preventing customers from using their own intelligent assistants to book travel will seem as antiquated as requiring everyone to call an airline ticket office.”
“I think United’s caution makes sense. When you let an AI agent act on a customer’s behalf, you’re giving it access to parts of the site that are only available after login. A malicious agent could look for weaknesses in those areas, where it may be able to do more damage. From the outside, it’s hard to tell whether United is acting out of general caution or has specific concerns about what agents could do once authenticated.
“I also understand the concern about having passengers personally acknowledge that their bags don’t contain prohibited items. That’s a declaration you’d want the passenger to make directly. I expect we’ll see more of this from SaaS vendors. They’ll increasingly treat their authenticated services as walled gardens and decide which agents, if any, they’re willing to let in.”
ㅤIt’s about time that someone did this as AI agents do not have the required controls present. Hopefully others follow this lead.
The Great Microsoft Outage Has Been Fixed…. Rejoice!
Posted in Commentary with tags Microsoft on November 13, 2026 by itnerdWell… .Maybe not as this was a “backhoe day” for many. And business globally ground to a halt for a day and a half. Having said that, Microsoft has said this:
A couple of things. I am seeing things acting “sort of normal” from about 2PM EST. I also sense that this is more of a “please don’t leave us for Goggle Workspace” than a legitimate apology. But maybe I am looking at this from a cynical point of view. Also, you may note that things may still be problematic. But at least they seem to be headed in the right direction.
Finally, Microsoft says that this wasn’t AI (as I am guessing that they don’t want to curtail sales of CoPilot) or a threat actor at work. Basically, Microsoft screwed up. That alone will make reading the root cause analysis interesting.
Leave a comment »