Cybersecurity Weekly Incident Roundup: November 12, 2026
In an ongoing series addressing cybersecurity incidents and breaches worldwide, the ISMG (Information Security Media Group) highlighted notable events that transpired during the preceding week. This report covers a significant revocation of certificates by eMudhra, a major outage affecting Microsoft 365 services, vulnerabilities allowing the exploitation of connected vehicles, and other critical security incidents, including a destructive wiper attack on the Russian cloud provider Beget.
eMudhra Revokes Eight More Certificates
Public key infrastructure firm eMudhra has taken decisive action by revoking eight additional intermediate certificates. This decision follows the discovery of a software flaw that unveiled private key materials during the certificate generation process back in April 2025. With this latest revocation, the overall count of compromised intermediate certificates has surged to 16.
The Indian company had previously halted its global TLS certificate operations in October, after it was revealed that it had issued intermediate certificates using a private key that was alarmingly only one byte long—far below the industry standard of 48 bytes. Major tech companies such as Mozilla, Google, Apple, and Microsoft responded by blocking these weak certificates, often taking the extra step of barring the root certificate from which the flawed certificates were generated.
Initially, eMudhra deemed eight RSA-based Certificate Authorities (CAs) as unaffected by the incident, but further investigation revealed that the custom Python script responsible for transferring keys had also manipulated the RSA keys. Subsequent findings indicated that while the RSA keys were not truncated, the company’s internal protocols might not have adequately safeguarded the cryptographic material. Consequently, on November 7, eMudhra retracted these affected certificates, affirming their commitment to industry-standard practices in key management.
Major Microsoft Outage
In another significant incident this week, business and enterprise users of Microsoft 365 faced considerable disruptions when services, including Outlook, faltered around mid-morning on the U.S. Eastern Seaboard. By late afternoon, the tech giant identified the cause as a slew of unexpectedly unavailable servers, as contrasted with an initial assumption of overwhelming traffic.
Microsoft maintained transparency about the nature of the outage, asserting that it stemmed from "failed health checks" linked to a specific component within the affected servers. Although there was no indication of a cyberattack, the disruption caused widespread frustration among users relying heavily on Microsoft’s productivity suite.
In a proactive measure, the company managed to resolve connectivity issues for Teams and was able to restore a subset of affected servers by validating an alternative service health check method.
Default Password Exposes Connected Vehicles
Security researchers have uncovered alarming vulnerabilities within the mobile applications of two automakers that allowed unauthorized access to customer accounts. Using the default password “admin,” researchers Shubham Shah and Sam Curry took advantage of a publicly accessible identity management system, exposing severe security flaws.
The identity platform employed by the automakers contained an insecure Apache Felix administrator console. Accessing this console enabled the researchers to execute scripts that allowed them to remotely unlock and start vehicles, demonstrating the severity of the leak. While the automakers promptly addressed these vulnerabilities, the incident underscored the critical repercussions associated with poor cybersecurity hygiene.
Hackers Exploit Qubole’s AWS Access
Meanwhile, cloud security company Wiz reported a data breach at Qubole, where attackers exploited trusted access to customer AWS environments between October 14 and October 26. The attackers leveraged credentials tied to a Qubole AWS account to gain unauthorized access to customer resources, facilitating the theft of sensitive data and credentials from multiple organizations.
The hackers were able to navigate through customer accounts by employing valid external IDs held within their trusted framework, thereby bypassing the existing security measures. Once inside, they rummaged through a treasure trove of sensitive information, including AWS Secrets Manager data and Microsoft Entra client secrets, amplifying concerns regarding cloud security protocols.
Wiper Attack Forces Beget to Rebuild Infrastructure
In a more destructive event, Russian cloud and hosting service provider Beget experienced a wiper attack that necessitated the total reconstruction of its infrastructure. The attack, which took place on November 1, resulted in significant data loss as the intruder accessed management systems and executed malicious scripts that obliterated complete data sets.
Beget quickly recognized the intrusion and promptly disconnected its servers to curb further damage; however, the company reported total losses of its VPS binary backups, leaving some customer data irretrievable. Beget reassured its clientele that recovery efforts, which include rigorous inspections of servers for vulnerabilities, were ongoing.
SonicWall, Taiwan Hacker, and Data Breach Updates
Further issues came to light as SonicWall released patches for vulnerabilities within its SSL-VPN software, including one critical flaw allowing attackers to bypass multi-factor authentication. Additionally, news emerged regarding a Taiwan hacker employing AI agents to target organizations across eleven countries, capitalizing on automated tools for malicious reconnaissance and exploitation. This is a stark reminder of the evolving threats in the cybersecurity landscape.
Lastly, Amplifon, an Italian hearing care provider, revealed a data breach exposing sensitive information of 1.33 million customers. The breach, attributed to suspicious network activity, compromised personal healthcare information, compelling the company to notify state authorities about the incident.
This week’s roundup illustrates the continuing cybersecurity challenges faced by organizations globally, with threats ranging from lapses in password security to formidable attacks disrupting established infrastructures. As the digital landscape becomes increasingly vulnerable, the necessity for robust security measures remains paramount.