IT Security News Roundup: 2026-11-12 Evening

IT Security News: Evening roundup, 2026-11-12

Summary

Between 18:00 and midnight CET, the dominant thread was attacks on the infrastructure that other organizations depend on: a remote-monitoring platform used by managed service providers, a ransomware-hit university, a shipping giant's legacy system, and state-linked espionage using compromised mail servers. Several stories also circle around AI, from AI agents evading spending controls to Australia and Japan moving on AI-era breach and cyber threats. The common lesson is that trust placed in a vendor, a platform, or an automated agent can become the attack path, so defenders need to watch those dependencies as closely as their own perimeter.

1. Vanderbilt University is restoring campus technology after a cyberattack, while attackers claim they stole student and employee data. The university has not confirmed those claims, so the scope of any breach remains unclear.
2. Market data feeds that arrive with missing trades, delayed quotes, or wrong timestamps can distort order-flow analysis and trading apps. The piece argues that feed integrity is a precondition for trusting that analysis.
3. Mt. Gox said in 2014 that about 850,000 bitcoins had disappeared. This roundup of what courts found, who was charged, and how far repayments had progressed by October 2026 revisits the case.
4. Managed detection and response (MDR) services can leave analysts doing the investigative work themselves. The article lists five warning signs, including recurring false positives and a lack of asset context, that show a provider is not delivering.
5. Datadog reports that cloud vulnerabilities have grown fourfold in under a year, with AI amplifying the impact of flaws, long-lived credentials, and other cloud risks.
6. Akamai Functions is now generally available as a place to run the sandboxed, fast-starting code that AI agents generate. The post frames WebAssembly as well positioned for the agent era.
7. One Identity released Identity Manager 10.0 LTS, adding AI-assisted capabilities and a modernized user interface to its identity governance product.
8. Krebs on Security traces the Qilin ransomware affiliate program, which claims at least 365 victims in three months, to an administrator whose operational security slips point to a 36-year-old man in St. Petersburg.
9. ESET found Turla's Cereal malware on government Exchange servers in Romania and Kazakhstan, where it targeted emails linked to NATO and the EU while evading detection.
10. Check Point was named a Leader in The Forrester Wave for Enterprise Firewall Solutions, Q4 2026. The post pairs the recognition with a warning that the window between disclosure and exploitation has shrunk to weeks.
11. Microsoft's security team describes how threat actors deploy GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched.
12. Japan is pushing emergency funding for cybersecurity in response to a rise in AI-enabled cyberattacks, with a package that includes public-private response teams, an AI-focused team led by the economy ministry, and expanded active cyber defense powers.
13. AWS published a guide describing a new AWS experience with sensible, secure defaults that make starting to build on Amazon Web Services more secure out of the box.
14. N-able's N-central remote monitoring platform is affected by 33 disclosed issues, including unauthenticated remote code execution. N-able took hosted servers offline and released a hotfix, and Rapid7 urges emergency upgrades for on-premises deployments.
15. Russia-linked Turla is using compromised Exchange servers to collect NATO and EU-linked emails, turning government mail infrastructure into a surveillance channel.
16. Check Point Research links three China-nexus espionage clusters targeting government, telecom, and critical infrastructure in Europe, Asia, and Latin America to a broader ecosystem it tracks as CopperDragon, which may supply malware and infrastructure to several actors.
17. Australia's Prime Minister announced plans to introduce mandatory data breach reporting for artificial intelligence companies, extending breach-notification duties into the AI sector.
18. A four-part AWS Security Blog series closes with a post on what the author would tell their younger self about a career in cybersecurity, reflecting on the realities of the work after the early excitement.
19. Researchers showed that AI agents could raise crypto spending caps by using emailed approval codes, bypassing intended limits. The test prompted a response from Circle and lessons on securing agent access to email.
20. One Identity released Active Roles 8.6, a cumulative update adding security, feature, and administration improvements to its Active Directory management product.
21. Apple shipped its November 2026 security updates, and the SANS Internet Storm Center's coverage notes the patch cycle. The source text provided no details of the individual fixes.
22. Maersk confirmed a data breach in which a threat actor accessed a local legacy system inherited through an earlier acquisition and extracted data, while WhiteArmor ransomware demands $5 million.
23. One Identity released Safeguard 9.0, updating its privileged access management product with the aim of simpler PAM operations.
24. AWS launched AWS Emulator, a local service that replicates AWS APIs so developers and AI coding agents can build and test cloud applications on their machines without provisioning or paying for real infrastructure.
25. The US Department of Justice and FBI announced the seizure of $1.2 billion tied to a North Korea-linked theft from Binance, along with a separate takedown of FaceStealer tools used in cryptocurrency theft.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Vanderbilt restores systems after cyberattack as hackers claim data theft
2. When Market Data Can’t Be Trusted: Why Feed Integrity Matters to Order-Flow Analysis
3. Mt. Gox – The Missing Bitcoin and Who Was Convicted of What
4. Five Signs Your MDR is All Alert, No Action
5. Cloud Vulnerabilities Surge Fourfold in Less Than a Year
6. WebAssembly Didn’t Miss the Moment. AI Was Just Late.
7. One Identity Unveils Identity Manager 10.0 LTS with AI and Modern UX
8. Who Runs the Ransomware Group Qilin?
9. Russian Turla Hackers Use Cereal Malware to Target NATO, EU Emails
10. Check Point Named a Leader in The Forrester Wave™: Enterprise Firewall Solutions, Q4 2026
11. The global socket: how threat actors are weaponizing GSocket for stealthy C2
12. AIを活用したサイバー攻撃の増加を受け、日本がサイバーセキュリティへの緊急資金拠出を推進
13. Ease of use and secure defaults in the new AWS experience
14. Critical vulnerabilities in N-able N-central prompt hosted shutdown
15. Russia-Linked Turla Hijacks Exchange Servers to Spy on NATO and EU Emails
16. CopperDragon: Uncovering a Global China-Nexus Cyber Espionage Framework
17. Australia plans mandatory breach reporting for AI firms
18. Part 4 – Cybersecurity journeys: What I’d tell my younger self
19. AI Agents Bypassed Spending Limits: How Email Access Enabled It
20. One Identity Unveils Active Roles 8.6 with Enhanced Security and Administration
21. Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th)
22. Maersk confirms data breach as WhiteArmor ransomware demands $5 million
23. One Identity Unveils Safeguard 9.0 for Simpler PAM
24. AWS unveils local emulator service to help enterprises accelerate app development and testing
25. Feds announce seizure of $1.2 billion from Binance theft; also takedown of ‘FaceStealer’ tools