IT Security News Roundup: 2026-11-14 Afternoon

IT Security News: Afternoon roundup, 2026-11-14

Summary

Between noon and six on 14 November, the stories clustered around three threads: third-party and supply-chain exposure, AI tools becoming both an attack vector and a defensive product, and state-linked or organized criminal operations. Breaches at vendors such as Fireworks AI and a Baker Tilly service provider show how one weak link spreads data loss to many customers. Vendors, meanwhile, are pitching AI-driven security tools while researchers warn that attackers are using AI to speed up intrusions. For security teams, the practical message is to audit suppliers, watch for phishing that piggybacks on real outages, and check what their own tooling can actually see.

1. Falcon Cloud Security, CrowdStrike's cloud security product line, received new features aimed at protecting the cloud infrastructure that AI workloads run on. The post is a product announcement with few technical details.
2. Uber is notifying thousands of US drivers that their driver's license and personal details were stolen in October after attackers compromised Fireworks AI, a third-party AI vendor holding Uber data. The incident shows how a vendor's breach can expose a company's own users.
3. Researchers describe how adversaries exploit the wider vulnerability ecosystem, including public disclosures and patch timelines, to outpace defenders. The article is a short summary, so its specifics are limited.
4. The U.S. government disrupted a North Korean social engineering campaign called FaceStealer, which was linked to more than $400 million in cryptocurrency thefts. The takedown targets a major revenue stream for the regime.
5. CrowdStrike added enterprise browser security to its Falcon platform, bringing browser-level protection into the same console as its endpoint tooling. The post is a product announcement with few technical details.
6. CrowdStrike extended its agentic SOC so that AI agents can be monitored for insider-style threats, such as an agent misusing its access. The announcement is a product update rather than a reported incident.
7. SilentAir is a state-linked espionage group that hijacks telecom signalling to redirect victims' calls and texts, including SMS 2FA codes, to attacker-controlled numbers. The research, from Enea, found compromised devices inside mobile operators in at least six Asian countries.
8. Hudson Rock found that two university email addresses tied to Italy's school bomb threats appeared in infostealer logs, pointing to the sender using previously stolen credentials. Around 6,000 Italian schools reportedly received the threats on 11 November.
9. A SecurityWeek opinion piece argues that heavy reliance on AI could erode the creative thinking, clear communication, and critical reasoning security teams need when no playbook exists. It is a commentary rather than a reported incident.
10. A new worm-like toolkit called SCKit spreads from infected customer machines to the technicians' computers at managed service providers, letting attackers reach additional client networks through ScreenConnect. The MSP supply chain is the key risk.
11. CrowdStrike introduced agentic adversary emulation, which uses AI agents to simulate attacker behaviour so defenders can test against AI-enabled threats. The post is a product announcement.
12. SilentAir has been observed targeting telecom networks across Asia and beyond, with a focus on Taiwan, to intercept calls and SMS verification codes. Enea believes the campaign is state-sponsored, though it could not confirm any account takeovers.
13. A campaign called wfx-loot used 4,837 compromised GitHub accounts to scan 61,764 repositories, open malicious pull requests, and push secrets-stealing malware aimed at cloud credentials. It shows how stolen developer accounts can become a path into cloud environments.
14. Security Latest reports that attackers with limited skills are using AI tools to run ransomware operations, even though fully automated ransomware has not yet appeared. The rise in low-skill, AI-assisted attacks is the main concern.
15. Microsoft issued a statement after a service disruption affecting its customers and partners, saying the outage was a technical problem unrelated to cyberattacks or AI agents. Microsoft says broad recovery and stability have been restored.
16. Hackread reports that a growing set of security roles now focuses on overseeing enterprise AI agents, which read shared mailboxes and other business data. The shift reflects how much access these assistants now have.
17. The White House AI Task Force urged federal regulators to hold off on enforcement against companies hit by AI-driven cyberattacks, for at least 12 months. The task force also wants voluntary reporting of vulnerabilities and incidents.
18. Hackers stole personal information from the University of Texas at Arlington after a cyberattack that disrupted its MachForms registration platform, which remains offline. The Qilin ransomware group has claimed the attack, and the university has not yet determined the full scope of the data loss.
19. CISA added a high-severity UnrealIRCd flaw, CVE-2026-114713 with a CVSS score of 8.6, to its Known Exploited Vulnerabilities catalog after attackers began exploiting it. The bug allows command injection at server level on the open-source IRC server.
20. Operation Endgame took down the infrastructure behind the Gootloader, CastleRAT, and StealC malware families, seizing 235 servers and 257 domains. Authorities also recovered about 6.4 million stolen credentials tied to more than 40,000 victims.
21. The FBI warned in a November 13 FLASH alert that hackers are using ARTEX, an open-source AI agent, to automate network intrusions and reach privileged access in under three hours. Attackers combine stolen credentials, exposed applications, and cloud permissions to shorten the path to compromise.
22. Microsoft warned of an active phishing campaign that uses the November 12 Microsoft 365 disruption as a lure, with fake email recovery links copying real service health notices. The emails cite the genuine Exchange Online incident EX1550543 to look legitimate.
23. Apple detailed the architecture of Secure Exclaves, which isolate camera and microphone sensor data from the main operating system on HomePod-class devices and new iPhones. The design limits what a compromised OS can access.
24. Cursor described how a leaked Fireworks AI key was used to backdoor a Claude Code extension. The incident shows how a single exposed API credential can compromise a developer tool.
25. Third-party risk management is the focus of an enterprise guide published this period. It is a general reference piece rather than a reported incident.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. New Falcon Cloud Security Innovations Secure the Cloud AI Runs On
2. Uber Data Breach: Driver Licenses Stolen via Fireworks AI
3. How Adversaries Are Turning the Vulnerability Ecosystem Against Defenders
4. US disrupts North Korean campaign behind $400 million crypto theft
5. CrowdStrike Brings Enterprise Browser Security to the Falcon Platform
6. CrowdStrike Extends the Agentic SOC to Detect and Stop Agent Insider Threats
7. SilentAir
8. The School Bomb Threats Came From Accounts Already in Stolen Data
9. Is AI Making Us Worse at Cybersecurity?
10. New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks
11. CrowdStrike Introduces Agentic Adversary Emulation to Counter AI-Enabled Adversaries
12. SilentAir Hacks Asian Telecom Networks to Intercept Calls and SMS Verification Codes
13. Hackers compromise 4,800 GitHub accounts to steal cloud credentials
14. Beware the New AI-Fueled Ransomware Boom
15. Statement from Microsoft
16. The Security Jobs Growing Around Enterprise AI Agents
17. White House AI Task Force Urges Leniency on Cyberattack Penalties
18. Hackers Steal Personal Information in Cyberattack on University of Texas at Arlington
19. Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection
20. Operation Endgame Takes Down Three Malware Networks, Recovers 6.4 Million Stolen Logins
21. FBI Reveals How Hackers Use ARTEX AI Agents to Gain Privileged Access in Under Three Hours
22. Microsoft Warns of Active Password Stealing Attack Exploiting the Microsoft 365 Service Disruption
23. Apple Reveals How Secure Exclaves Shield Camera and Microphone Data