WIRE home · World Instability · Business · Economics · Tech & Cyber · Orthodox · Archive · Subscribe
Download PDF · Dashboard image · All Technology & Cyber editions
UNCLASSIFIED // OPEN SOURCE | Friday, 13 November 2026 | Vol. 2026-317 | As of 130725 EST NOV 26
BLUF. WIRE Technology & Cyber holds at ENVIRONMENT FOR CRISIS, trend ↑, now set jointly by critical-infrastructure cyber and AI and cloud incidents. A Microsoft 365 outage that began shortly before 1 p.m. ET on 12 Nov was still not fully fixed at 6 a.m. ET today. It took down Outlook and hit Teams, Copilot and SharePoint across regions, and UK police and NHS services were affected. Microsoft says it sees no malicious activity. Ransomware.live now lists 305 victims discovered 9–13 Nov, so the week will close well above the 8-week mean. Monadnock Community Hospital (New Hampshire) still diverts ambulances and expects its unexplained server outage to last through 18 Nov. Vanderbilt still has not said what data was taken. CISA added no exploited flaws on 12 Nov (week count 10). No TEC calls resolve today; TEC-10 is checked against the full day in the next edition.
| TOPIC | CRISIS LEVEL | DOM. INDICATOR | KEY DRIVER (today) | TREND |
|---|---|---|---|---|
| TEC-T1 Critical-infrastructure cyber | ENVIRONMENT FOR CRISIS | SIGNIFICANT | K-3: EFS cold-room attack in window; K-4: 305 leak-site victims, 9–13 Nov | = |
| TEC-T4 AI governance and incidents | ENVIRONMENT FOR CRISIS | SIGNIFICANT | AI-3: Microsoft 365 outage, 18+ h, multi-region, public services hit | ↑ |
| TEC-T3 Space and undersea infrastructure | NO CRISIS | ABNORMAL | O-1: one failed attempt (Lithuania, 18 Oct) in window | = |
| TEC-T2 Semiconductors and compute | NO CRISIS | ROUTINE | X-1: no new BIS rule; MOFCOM No. 72 pause still ends 27 Nov | = |
Family level = highest topic level. Roll-up per WIRE_METHOD §1a. Trend key: ↑ toward crisis, ↓ away, = no net change.
Change line. Family level unchanged at ENVIRONMENT FOR CRISIS; trend moves from = to ↑ because TEC-T4 rises from NO CRISIS to ENVIRONMENT FOR CRISIS.
Moved indicators (vs 12 November). AI-3 ABNORMAL → SIGNIFICANT (Microsoft 365 outage). K-4 is now effectively ABNORMAL (305 with three days left; scored formally when the week closes).
Facts. The KEV feed is unchanged at catalogVersion 2026.11.10 with 1,779 entries; the 9–15 Nov count stays at 10 (KEV feed). CISA's alerts page shows nothing after 10 Nov (CISA advisories). On 12 Nov CISA republished five Siemens ICS advisories, four for products used in energy and building automation, covering the Node.js Brotli flaw CVE-2026-111497 (CVSS 9.8); some Industrial Edge components still have no fix (CISA ICS advisories; ICSA-26-316-03). Ransomware.live counts by discovery day are now 100, 67, 36 and 99 for 9–12 Nov, plus 3 so far on 13 Nov (UTC), a total of 305 (feed). New 12 Nov listings include a Panzer claim against Malaysia's Ministry of Health, an N0n claim against LEO Pharma, and a Vexy claim against Nigerian fuel firm Franc-Oil (same feed). Monadnock Community Hospital said at 8 p.m. on 12 Nov that restoring systems "is taking longer than expected" and that it expects the outage to continue through 18 Nov. Its emergency department is open but remains on ambulance diversion, and elective surgery, outpatient radiology and lab work are suspended (MCH update). Spokespeople have declined to give a cause (Monadnock Ledger-Transcript). Vanderbilt's latest update (1 p.m., 11 Nov) says full restoration may take weeks and that it is working with government agencies and law enforcement (Vanderbilt updates). In Singapore, the Ministry of Health said on 12 Nov that cyber incidents at six healthcare entities have not disrupted patient care; the latest, at the Agency for Integrated Care, may have exposed data on up to 4,064 staff (CNA). Indicators. K-1 ABNORMAL (10); K-2 ABNORMAL (carried); K-3 SIGNIFICANT (EFS, 2 Nov, in window; Monadnock is a single site with no confirmed cyber cause); K-4 ROUTINE pending week close (305 with three days left; the ABNORMAL line is about 313); K-5 ROUTINE. Roll-up: ENVIRONMENT FOR CRISIS. Trend =. Analyst Comment. A ten-day outage forecast, paper charting and silence on cause fit the pattern of a ransomware recovery more than a failed upgrade, so TEC-39 stays at about even or better. Diversion is unlikely to end before the hospital's own 18 Nov estimate (new TEC-42).
Facts. Microsoft 365 connectivity problems began shortly before 1 p.m. ET on 12 Nov and affected Outlook, Teams, SharePoint and Copilot. Microsoft blamed servers that were unexpectedly unavailable after failing automated health checks, which put load on the rest, and said it was not aware of malicious activity. At about 6 a.m. ET on 13 Nov it said users might still be unable to reach Outlook and gave no timeline (CNBC). The Guardian reports UK police, NHS services and schools were affected, and that Microsoft is rolling back a recent configuration change (Guardian live). Downdetector logged nearly 130,000 Outlook reports at the peak (CBC). Microsoft extended the email retry window to 48 hours to protect delayed mail (CNBC). The Federal Register shows no AI rule since 12 Nov; the only match is an Education Department request for information (FR API). Indicators. AI-1 ABNORMAL; AI-2 ABNORMAL; AI-3 SIGNIFICANT (multi-region outage at a major cloud provider, including its AI assistant, disrupting public services). The −1 override used since October is dropped, because its basis (single products or regions, no critical services) no longer holds. Roll-up: ENVIRONMENT FOR CRISIS. Trend ↑. Analyst Comment. The cause appears to be capacity and configuration, not AI or an attack, so this is a concentration-risk signal rather than an AI-safety one. It shows how one provider's failure reaches police and health services at once (TEC-41).
Facts. No new attributed ground-station or cable attack found for 12–13 Nov. Ireland's government warned on 11 Nov of a growing threat to subsea cables from "malign actors" (Al Jazeera). Indicators. O-1/O-2/O-3 ABNORMAL (carried). Override −1 to NO CRISIS (held): the only event in the window failed. Trend =.
Facts. No BIS document published since 11 Nov (FR API). No MOFCOM extension of the No. 72 (2025) pause was found; it ends 27 Nov (MOFCOM). Indicators. X-1–X-4 ROUTINE. Roll-up: NO CRISIS. Trend =.
Resolved: none. TEC-10 (PHP fix for CVE-2026-115560 by 13 Nov): php.net still lists 8.5.12 (21 Oct) as current, php-src has only an 8.5.13RC1 tag, and no advisory names the CVE (php.net releases; php-src advisories); it is scored after the day ends. TEC-33 (KEV ≥ 10 in 9–15 Nov) has met its threshold and TEC-32 (180–299 victims) is very likely a miss; both are scored on 16 Nov per their criteria. New: - TEC-41: Microsoft states the Microsoft 365 outage is resolved or fully mitigated by 23:59 ET on 14 Nov 2026. 70%, likely. - TEC-42: Monadnock Community Hospital says it has ended ambulance diversion on or before 18 Nov 2026. 35%, unlikely.
CISA KEV, alerts and ICS advisories; ransomware.live; Monadnock Community Hospital; Monadnock Ledger-Transcript; Vanderbilt News; CNA; CNBC; The Guardian; CBC; Federal Register; Al Jazeera; MOFCOM; php.net; php-src on GitHub.
WIRE Technology & Cyber | WIRE Desk | Open-source analysis. Not investment, legal or voting advice. UNCLASSIFIED // OPEN SOURCE.
Every WIRE, every morning. Unsubscribe anytime.
Prefer the website? Subscribe on Substack.
WIRE home · World Instability · Business · Economics · Tech & Cyber · Orthodox · Archive · Subscribe
