Here’s a look at the outages, cyber incidents, and data-system issues that stood out from Thursday midday through early Saturday morning, from COiN Services.
Top items
1. The Microsoft 365 outage is over
Outlook, Teams, Copilot, and Exchange Online were down worldwide for more than 24 hours, starting around 12:25 p.m. ET Thursday. Microsoft said Saturday that all services had fully recovered, and that a technical issue following a recent network change caused it, not an attack. Downdetector logged more than 7.4 million reports. City governments, courts, hospitals, and transit services saw email trouble, while organizations running Exchange on their own servers were mostly spared. Some mail may still arrive late while the backlog clears. Sources: Reuters, BBC, and NBC.
2. FAA nationwide ground stop on Friday
Communication and radar instability at air traffic control centers began around 3:36 p.m. ET Friday. All U.S. airports were grounded, and airspace reopened at 8:15 p.m. ET. The stated cause was overloaded switches and routers on aging air-traffic communications equipment. Officials said there was no evidence of a cyberattack. Nearly 10,000 flights were canceled, and delays may last for a few days. Sources: FAA, Reuters, and Los Angeles Times.
3. Attackers are going after managed service providers through ScreenConnect
Since November 11, attackers have been breaking into cloud-hosted ScreenConnect instances used by managed service providers. Microsoft has confirmed the activity. The attackers push a rogue remote-access client and a worm called SCKit onto managed computers, and a component named RelayTrap targets the technicians who connect. If you use remote-support software like ScreenConnect, make sure it is updated and locked down. Source: Microsoft Security Blog.
4. Check Point zero-day gives attackers root on Gaia firewalls
A privilege-escalation flaw in Gaia OS, tracked as CVE-2026-123039, was used to get root access through the Mobile Access portal. Check Point says about two dozen customers were hit. Emergency hotfixes are out, and CISA added the flaw to its Known Exploited Vulnerabilities list on November 13. Source: BleepingComputer.
5. November’s Windows updates break activation
Microsoft confirmed error 0x80041008 when running activation commands on Windows 10 21H2 and 22H2, Windows 11 23H2, and Windows Server 2019, 2022, and 2025. Machines that are already activated stay activated, and a fix is coming. Source: BleepingComputer.
Also noted
- AT&T had a partial outage Thursday from about 10 a.m. to 1 p.m. ET, affecting the app and the network in some areas. Source: Android Authority.
- Reports of 911 trouble remain unconfirmed. They come only from user-report trackers, peaking around 298, and no official cause has been given. Clay County, Florida, said its 911 center was not affected. Source: Cybernews.
- Cloudflare R2 had errors overnight from about 12:00 to 1:45 a.m. ET, mostly in Chicago and Newark, caused by a network issue between data centers. The problem has been resolved. Source: Cloudflare Status.
- Uber is notifying drivers that license and personal data were stolen through a breach at its vendor Fireworks AI. Source: TechCrunch.
- Trezor Safe 5 wallets sold by the reseller CryptoBilis had hardware implants that steal recovery phrases. A firmware fix is out, and no funds have been reported lost. Buy hardware wallets direct from the maker. Source: BleepingComputer.
- Vanderbilt University is still responding to a ransomware attack first confirmed earlier this month. Source: BleepingComputer.
Solomon’s Vault
When your email lives in the cloud, a copy of your important files should live somewhere else too. Solomon’s Vault from COiN Services keeps encrypted, off-site backups of your PC running every day, no matter whose cloud is having a bad day. And restoring a file is a few clicks, not a support ticket.
Watch the Restore a lost file video to see how a restore works.
Watch: Solomon’s Vault in 30 seconds
Catch up on past reports: Daily Tech Report archive
Leave a Reply