IT Security News Roundup: 2026-11-13 Evening

IT Security News: Evening roundup, 2026-11-13

Summary

The 18:00–00:00 CET window was dominated by AI cutting both ways. Attackers are running open-source AI pentesting frameworks like ARTEX and AntiFox against real targets, while vendors such as OpenAI are pitching their own AI security agents. A second thread is fragility: a Microsoft 365 outage, a FAA ground stop, and a BrickLink shutdown all show how much depends on a few centralized systems, and a set of exposed Grok apps and internet-connected refrigerators shows how many devices and apps are being shipped without basic protection. For IT security readers, the takeaway is that attacker speed and infrastructure concentration are both rising, so detection, containment, and resilience planning matter more than ever.

1. Schneier on Security's weekly squid post covers Pacific flying squid declining in Korean waters due to climate change, with a note that readers can use it for uncovered security news. It is off-topic for security.
2. Bloomberg's investigation, building on Citizen Lab research, identifies more government customers of Penlink's Webloc, an ad-based surveillance system used by security agencies worldwide.
3. CISA's acting chief issued an internal memo setting operational priorities around partnerships, risk assessments, and systemic action, directing senior leaders to apply them to their decisions.
4. OffSec marks 20 years of hands-on training from the creators of Kali Linux and OSCP, and is now extending that practitioner-built approach to entire cyber teams.
5. A Microsoft 365 outage on November 12 disrupted Outlook, Teams, and Copilot for thousands of US users, and also broke the connectors that OpenAI and Anthropic use to reach Microsoft accounts.
6. The US Department of Justice seized more than $1.2 billion tied to North Korea's Binance theft and disrupted infrastructure behind a FaceStealer social engineering scheme, warning the same hackers target open-source developers.
7. Researchers found more than 35,000 Grok-built apps accessible without any login, some exposing corporate files, patient records, and employee credentials.
8. Europol and Eurojust supported the fifth EMPACT Hackathon in Amsterdam, where 40 experts from 20 countries identified 51 potential human trafficking victims and five suspects.
9. The BrickLink Lego marketplace has been offline for almost a week after "unusual activity," with users still waiting for a confirmed cause.
10. Hackers are actively exploiting a newly disclosed N-able N-central zero-day, "4EverAble2Shell," within hours of a public proof-of-concept, compromising servers to deploy cryptocurrency miners across at least 21 systems, 19 of them on the latest update.
11. Check Point links three China-nexus hacking clusters to a suspected Chinese malware supplier, all sharing the Sparrow malware framework.
12. The FAA issued a nationwide ground stop citing "extraordinary circumstances" and safety, and officials have not said whether a cyberattack or communications failure is involved.
13. The FBI issued a flash alert warning that the open-source Artex tool automates attack chaining, with some intrusions reaching privileged access in under three hours.
14. Microsoft attributed a major Outlook outage to "elevated loads" as it worked to restore service to business and enterprise customers.
15. The FAA's nationwide flight grounding was reported by TechCrunch as citing "reasons of safety," with no cause given in the source text.
16. OpenAI launched security products and warned organizations they will fall behind if they don't adopt them, while a group of nonprofits sued AI companies citing AI-driven cyberattacks.
17. Google's Android 17 QPR2 update reached Pixel devices early with critical security fixes, and the post walks readers through supported models and how to verify installation.
18. AntiFox, an emerging agentic penetration testing platform, was used in intrusions that stole AWS credentials and moved laterally, with Alibaba Cloud systems hosting its interfaces linked to malicious actions.
19. A cyber briefing for November 11 flagged a Chrome zero-day under active exploitation and nearly 100 Fortinet flaws fixed in one release.
20. Amazon Threat Intelligence's MadPot decoy sensors captured AI agent requests carrying memory from offensive campaigns that threat actors ran with the open-source ARTEX agentic pentesting framework, between October 3 and November 5.
21. Unit 42 uncovers Falcon C2, a browser-based threat framework targeting governments through malicious scripts, extensions, and the Antino implant.
22. VulnCheck disclosed 14 vulnerabilities in Dixell refrigeration units that give attackers root access, while online honeypots are being flooded with hacks and probes.
23. Fortinet argues that graduated containment, independent enforcement, and human oversight can limit the harm AI agents cause while preserving business continuity, as an alternative to a simple kill switch.
24. SentinelOne describes how its Behavioral AI, Singularity AI SIEM, and Purple AI can detect and stop autonomous ARTEX attacks across cloud, identity, and endpoints.
25. eSecurityPlanet explains the security risks of the Microsoft 365 outage, noting it disrupted critical security tools, and outlines five cybersecurity risks and how to strengthen cloud resilience.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Friday Squid Blogging: Pacific Flying Squid Populations Dropping in Korean Waters
2. Security Agencies Worldwide Found to Use Ad-Based Surveillance System
3. CISA sets operational priorities for partnerships, risk assessments and systemic action
4. OffSec Celebrates 20 Years of Practitioner-Built Training From the Creators of Kali Linux and OSCP
5. Microsoft Cloud Outage Hits Outlook, Teams, Copilot and AI Services
6. North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure
7. No Login Needed: Over 35,000 Grok Apps Were Publicly Accessible
8. 5th EMPACT Hackathon leads to the detection of 51 potential victims
9. Lego marketplace BrickLink in pieces after 'unusual activity' takes it offline for almost a week
10. New N-able "4EverAble2Shell" zero-day exploited hours after PoC released
11. Suspected Chinese Malware Supplier Tied to Three Hacking Campaigns
12. FAA Ground Stop Issued Due to ‘Extraordinary Circumstances’
13. FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’
14. Major Microsoft Outlook Outage Leaves People With Email Jobs Unable to Email
15. US government grounds all flights across the United States ‘due to extraordinary circumstances’
16. OpenAI launches security products, tells orgs they’re doomed if they don’t use them
17. Android 17 QPR2 Rolls Out Early With Critical Security Fixes
18. AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets
19. CYBER BRIEFING | NOVEMBER 11, 2026
20. Amazon Threat Intelligence observes threat actors running cybercrime campaigns with ARTEX AI agents
21. The XG Files: Falcon C2 Flying Under The (Browser) Radar
22. Researchers continue to find serious vulnerabilities in internet connected refrigerators
23. Beyond the Kill Switch: Containing AI Agents at Machine Speed
24. ARTEX Unmasked | The Rise of AI-Powered ARTEX in Cybercrime & Espionage
25. Microsoft 365 Outage Raises Security Concerns: What You Need to Know