> ## Content Index > Fetch the complete content index at: https://www.cyberverso.net/llms.txt > Use this file to discover other available public pages before exploring further. # Cyber / Brief, 12 Nov 2026: Nvidia's board weighs ousting Jensen Huang as FBI looks into spy claim - URL: https://www.cyberverso.net/brief/cyber-brief-12-nov-2026/ - Published: 2026-11-11T23:34:29.000Z - Updated: 2026-11-11T23:34:27.000Z - Description: Nvidia's board was due to meet in urgent session on Jensen Huang's future after reports of a second relationship, this time with a senior executive, and of a board ready to oust him, while the FBI looks into his affair with a woman US intelligence believes was recruited by China's… - Author: Paolo De Rosa - Tags: #bulletin, #signal, #en Nvidia's board was due to meet in urgent session on Jensen Huang's future after reports of a second relationship, this time with a senior executive, and of a board ready to oust him, while the FBI looks into his affair with a woman US intelligence believes was recruited by China's Ministry of State Security. In Washington the scandal keeps exposing the administration's split on chip diversion: Axios describes Commerce Secretary Howard Lutnick as the lone holdout who stalled action against suspected smuggling to China even after Trump approved it. Europe meets the AI question at the top on Friday, when leaders hold their first European Council on the technology and Finland and Estonia ask for EU-level arrangements to respond to serious AI incidents and for independent capacity to test frontier models, as Britain and France get fourteen governments to sign the first, non-binding code of conduct for the spyware trade. Threats to Europe take several forms: US prosecutors say an IRGC-run network directed attacks on synagogues and US targets in the Low Countries, Paris and London and plotted against a British air base, hoax bomb threats emptied more than 300 Italian schools, and Poland took its national e-government platform offline after a cyberattack while Crédit Mutuel Arkéa lost about €100 million to hackers. ## Top Stories - [CEO Jensen Huang's job is suddenly on the line at Nvidia](https://arstechnica.com/gadgets/2026/11/ceo-jensen-huangs-job-is-suddenly-on-the-line-at-nvidia/) — *Ars Technica* · AI & Power - [EU needs a system to respond to AI incidents, Finland and Estonia say](https://www.politico.eu/article/eu-needs-a-system-to-respond-to-ai-incidents-finland-and-estonia-say/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Cybersecurity and Data Protection – POLITICO* · EU & Technology - [Poland shuts down government services platform ePUAP following cyberattack](https://therecord.media/poland-shuts-down-government-services-platform-cyberattack) — *The Record from Recorded Future News* · Cybersecurity & Threats - [Scoop: Lutnick stalled curbing Nvidia chip sales to China — again — after Oval Office showdown](https://www.axios.com/2026/11/11/trump-lutnick-nvidia-china-chip-export-controls) — *Axios* · US & Technology - [Iran-backed network directed London attacks over FaceTime, US prosecutors say](https://therecord.media/iran-backed-network-directed-london-attacks-over-facetime) — *The Record from Recorded Future News* · Defence & National Security --- ## AI & Power [CEO Jensen Huang's job is suddenly on the line at Nvidia](https://arstechnica.com/gadgets/2026/11/ceo-jensen-huangs-job-is-suddenly-on-the-line-at-nvidia/) — *Ars Technica* Why it matters: The board of the company at the centre of US AI and export-control policy weighs removing its founder. Nvidia's board was due to hold urgent talks on Wednesday about Jensen Huang's future, the FT reports, after The New York Times revealed a relationship with a senior Nvidia executive and The Wall Street Journal reported that the board could oust him; the shares fell more than 8% after hours. It comes days after Huang admitted an affair with Alice Huang, an executive at an Nvidia customer whom US intelligence believes was recruited by China's Ministry of State Security, and after Trump said the FBI was looking into it. The board, which backed him on Sunday, has hired a former federal prosecutor to lead its own probe; Republican senator Kevin Cramer has called on him to resign. [Anthropic's Glasswing Finds Many Vulnerabilities Yet Delivers Few Fixes, Researcher Says](https://www.infosecurity-magazine.com/news/anthropic-glasswing/) — *Infosecurity Magazine* Why it matters: An outside count tests the gap between the flaws AI finds and the ones that get fixed. VulnCheck researcher Patrick Garrity, working from Anthropic's own public data, counts 37,966 findings claimed for Project Glasswing, of which 7,349 are in the public ledger, 5,276 validated as unique and only 217 fixed, under 0.5% of the total. He questions Anthropic's 94.2% true-positive rate given the duplicates and withdrawals; Anthropic said in October that it was bottlenecked on the human capacity to validate findings. [Hugging Face appears to be hosting a load of models that could be used for cyber attacks](https://www.transformernews.ai/p/hugging-face-appears-to-be-hosting) — *Transformer* Why it matters: The main open-weight hub hosts thousands of models stripped of their safeguards. Transformer counts more than 6,500 models tagged as abliterated, uncensored or heretic, meaning their safety guardrails were removed, on Hugging Face in July, with many still online. The platform's policy bars models designed for attacks or malicious code, and in October it removed one GLM-5.3 variant marketed as 'abliterated for offensive cyber', but not others from the same creator; it did not explain where it draws the line. Hugging Face is now owned by Nvidia. [Taiwan’s chipmaking giant TSMC to invest $1B in Anthropic, OpenAI](https://arstechnica.com/ai/2026/11/taiwans-chipmaking-giant-tsmc-to-invest-1b-in-anthropic-openai/) — *Ars Technica* Why it matters: The maker of nearly all AI accelerators takes stakes in the two leading US labs. TSMC's board approved up to $500 million in OpenAI preferred stock and up to $500 million of Anthropic shares at the expected IPO price, according to Reuters. Analysts quoted by The Wall Street Journal warn that such circular financing between suppliers and customers makes real AI demand harder to read; Nvidia has already put $30 billion into OpenAI and $10 billion into Anthropic. [Australia may make knowingly selling unsafe AI a crime](https://www.theregister.com/public-sector/2026/11/11/australia-may-make-knowingly-selling-unsafe-ai-a-crime/5308999) — *www.theregister.com - Articles* Why it matters: Australia weighs criminal liability for AI developers after an undisclosed agent incident. A review ordered after OpenAI's agents accessed non-public medical records, and OpenAI did not disclose it for weeks, makes 18 recommendations, including mandatory reporting of misaligned behaviour and security incidents and a possible 'failure to prevent' offence for companies whose models cause harm. The proposed new regulator would require security controls, independent evaluation and rapid incident notification; the criminal options go to two ministries and the Federal Police for study. [United won’t let your AI agent book your flight](https://www.theverge.com/ai-artificial-intelligence/1031623/united-unauthorized-ai-agents) — *The Verge* Why it matters: A major airline closes its booking to personal AI agents. United Airlines will let AI assistants show its flights but not complete bookings, citing privacy and federal rules such as the passenger attestations airlines must collect, The Wall Street Journal reports; CEO Scott Kirby said he does not want 'another middleman'. eBay and several major banks have also restricted unauthorised agents, which limits what assistants such as Meta's Muse and OpenAI's Dots can do. [Fable and Mythos 5.2: The System Card](https://thezvi.substack.com/p/fable-and-mythos-52-the-system-card) — *Don't Worry About the Vase* Why it matters: A close reading of where Anthropic drew its risk thresholds for its newest model. Zvi Mowshowitz reads the system card for Claude Fable 5.2 and Mythos 5.2, the same model with looser safeguards for biology and cybersecurity in Mythos. He agrees with Anthropic's decision not to trigger its second biology threshold and, tentatively, with its 'low' misalignment rating, but disputes the decision not to trigger the second autonomy threat model, and asks what result would have triggered it. [Anthropic IPO could lead to 'large correction' in markets, Fed official says](https://www.semafor.com/article/11/11/2026/anthropic-ipo-could-lead-to-large-correction-in-markets-fed-official-says) — *Semafor* Why it matters: A Fed governor ties the first frontier-lab listing to financial-stability risk. Federal Reserve Governor Michelle Bowman warned of a 'large correction' if AI returns fall short, citing about $800 billion of AI-related debt, off-balance-sheet liabilities and circular financing, and said a shock would slow the AI build-out. Anthropic's IPO, the first by a frontier lab, is set to price on 18 November and start trading the next day, Semafor reports. --- ## EU & Technology [EU needs a system to respond to AI incidents, Finland and Estonia say](https://www.politico.eu/article/eu-needs-a-system-to-respond-to-ai-incidents-finland-and-estonia-say/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Cybersecurity and Data Protection – POLITICO* Why it matters: Two digital front-runners set out an EU line on AI safety before the first leaders' summit on AI. In a letter seen by POLITICO, Finland and Estonia call for 'EU-level arrangements' to respond to serious AI incidents and for independent European capacity to evaluate the most advanced models, alongside investment in European frontier models; Rapporteur reports the paper also urges channelling private savings into tech growth. Leaders meet on Friday for the first European Council devoted to AI; Hungary had proposed national contact points for cases where providers lose control of their models. [Britain, France set out first guidelines for commercial hacking firms](https://therecord.media/britain-france-set-out-guidelines-for-commercial-hacking-firms) — *The Record from Recorded Future News* Why it matters: The Pall Mall Process produces its first conduct code for the spyware market. Fourteen governments in the Pall Mall Process, led by Britain and France, adopted the first guidelines for companies that develop, sell or finance commercial cyber intrusion capabilities: vet customers, build safeguards against misuse, monitor and report abuse, and halt sales when serious misuse is a credible risk. The text is non-binding and has no penalties; pressure is meant to come from the governments that buy the tools and license their export. [Spain probes TikTok over child sexual abuse material](https://www.rapporteur.com/news/spain-probes-tiktok-over-child-sexual-abuse-material/) — *Tech | Rapporteur* Why it matters: A national prosecutor acts on a platform the DSA supervises from Brussels and Dublin. Spanish prosecutors opened an investigation into TikTok over the creation and distribution of child sexual abuse material after fact-checkers Maldita.es found more than a thousand such posts with millions of views. The youth minister asked TikTok to suspend operations in Spain until the material is removed; the data protection agency will pass what it knows to Ireland's DPC, TikTok's lead EU regulator. TikTok says it removed the content. [European gaming firms say new EU consumer rules will ‘cripple’ the industry](https://www.politico.eu/article/european-gaming-firms-say-new-eu-consumer-rules-will-cripple-the-industry-digital-fairness-act/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Technology – POLITICO* Why it matters: The first industry pushback on the Digital Fairness Act targets its gaming rules. The Digital Fairness Act would bar pay-to-win micro-transactions aimed at minors, restrict loot boxes and switch in-game currencies off by default for under-18s, with fines of up to 6% of global turnover for the widest breaches. The European Games Developer Federation and Video Games Europe call the pay-to-win definition 'fundamentally flawed' and say it would cripple the sector; the text still has to pass Parliament and Council. --- ## US & Technology [Scoop: Lutnick stalled curbing Nvidia chip sales to China — again — after Oval Office showdown](https://www.axios.com/2026/11/11/trump-lutnick-nvidia-china-chip-export-controls) — *Axios* Why it matters: Axios describes the commerce secretary as the lone holdout against action on chip diversion. Trump approved action against companies suspected of diverting Nvidia chips to China for the third time this year after a Situation Room meeting with Bessent, Hegseth, Greer and Rubio, Axios reports, with Lutnick the lone holdout who then proposed a new delay; Trump had approved similar action in May and August. Commerce denied that Bessent confronted Lutnick. [Hawley backs nationwide data center moratorium](https://www.politico.com/live-updates/2026/11/11/congress/hawley-backs-nationwide-data-center-moratorium-01161019) — *Technology* Why it matters: The first Senate Republican to back a national pause on data centres. Senator Josh Hawley wants a federal moratorium on data-centre construction until Congress guarantees ratepayers no increases, the first Senate Republican to back one, after midterms in which Democrats who ran against data centres did well. Texas has halted new permits and Florida has tightened rules for large AI facilities. [Trump admin loses fight to spy on random journalists’ LinkedIn DMs](https://arstechnica.com/tech-policy/2026/11/trump-admin-loses-fight-to-spy-on-random-journalists-linkedin-dms/) — *Ars Technica* Why it matters: A court limits a leak inquiry's reach into journalists' sources on a platform. A federal appeals court ordered a lower court to substantially narrow a Justice Department demand for 18 months of LinkedIn communications from journalists in a military leak inquiry, ruling that it swept in confidential sources with no link to the case; a secrecy order had barred LinkedIn from telling them for a year. --- ## China & Technology [Piggybacking to the Frontier](https://www.chinatalk.media/p/the-us-is-selling-rl-environments) — *ChinaTalk* Why it matters: US data vendors sell Chinese labs the training environments that drive post-training gains. ChinaTalk finds at least nine US data companies, including Mercor, Surge AI, AfterQuery and Turing, selling roughly half a billion dollars of data to Chinese AI labs, part of it as reinforcement-learning environments used to post-train models in coding, cyber, finance, law and biology. It notes that post-training drives most gains within a model generation, and weighs whether this calls for controls. --- ## Threat Intelligence (CTI) **\[P2\]** [The XG Files: Falcon C2 Flying Under The (Browser) Radar](https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/) — *Unit 42* Why it matters: A browser-based framework hides espionage inside compromised government web portals. Unit 42 describes Falcon, a command-and-control framework that runs malicious JavaScript planted in webmail portals and government web applications to take over visitors' browsers, sideload Chrome extensions and deliver an implant that uses OneDrive for control. It compromised ministries of foreign affairs, defence and interior and law-enforcement agencies in one Middle Eastern and four Southeast Asian countries between March and May 2026. severity high · exploited in the wild · EU: NIS2 **\[P3\]** [Who Runs the Ransomware Group Qilin?](https://krebsonsecurity.com/2026/11/who-runs-the-ransomware-group-qilin/) — *Krebs on Security* Why it matters: Krebs traces the administrator of the most active ransomware programme. KrebsOnSecurity links Qilin's administrator, 'Haise', through older forum handles and leaked Russian records to a 36-year-old man in St Petersburg; Qilin claimed at least 365 victims in the past three months, according to NCC Group, and pays affiliates at least 80% of ransoms. The link was first shared by IntelHawk, which de-anonymises actors with AI. severity medium · exploited in the wild · EU: NIS2 · actor Qilin (90%) **\[P3\]** [AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets](https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html) — *The Hacker News* Why it matters: An open-source agentic pentest tool turns up in real intrusions into cloud accounts. Arctic Wolf says Alibaba Cloud systems hosting AntiFox, an AI-driven autonomous penetration-testing platform from GitHub, were tied to intrusions that compromised internet-facing IIS applications, planted web shells and then validated AWS credentials, enumerated cloud services and read secrets. severity medium · exploited in the wild · EU: NIS2, AI Act **\[P3\]** [The global socket: how threat actors are weaponizing GSocket for stealthy C2](https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/) — *Microsoft Security Blog* Why it matters: A relay tool keeps attackers in after the original flaw is patched. Microsoft has seen several unrelated actors install GSocket, an open-source relay tool, on compromised Linux servers so that access survives the patching of the web flaw used to get in; because traffic goes through a shared public relay network there is no attacker IP or domain to block. Devices with GSocket detections rose more than 350% from March to August 2026. severity medium · exploited in the wild **\[P3\]** [Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand](https://securelist.com/citrus-ransomware/121879/) — *Securelist* Why it matters: A new ransomware group uses LLM-written scripts inside victim networks. Kaspersky describes Citrus, a previously undocumented Russian-speaking group that attacks only Russian companies: it gets in through compromised contractors' VPN or RDP credentials, hides traffic in VLESS tunnels, deploys Sn00py-family ransomware and runs commands and scripts generated by large language models. severity medium · exploited in the wild --- ## Health & Cyber [Study Provides Insights into Impact of Cyberattacks on Hospital Care](https://www.hipaajournal.com/study-insights-impact-cyberattacks-hospital-care/) — *The HIPAA Journal* Why it matters: A count of attacks that disrupted care shows how little the breach record captures. The Health Management Academy counted at least 65 cyberattacks on US hospitals and health systems that disrupted care, affecting at least 305 hospitals in 36 states, one of them 140 hospitals; in 89% key systems went offline and staff worked on paper. Because HIPAA requires reporting breaches, not care disruption, many such attacks are missing from the federal record; the group proposes tracking downtime days, hours on diversion and postponed procedures. **\[P3\]** [SG: Fullerton Health server hit by cyberattack; personal data of migrant workers affected](https://databreaches.net/2026/11/11/sg-fullerton-health-server-hit-by-cyberattack-personal-data-of-migrant-workers-affected/) — *DataBreaches.Net* Why it matters: Health provider breach exposes migrant workers' identity data. Fullerton Health says unauthorised access to a server supporting its Migrant Worker Primary Care Plan exposed workers' names, foreign identification numbers, dates of birth, phone numbers, email and home addresses; it says no health, medical or financial data was involved and has not said how many were affected. severity medium · EU: GDPR **\[P3\]** [Insider Data Theft Incident Reported by Premise Health](https://www.hipaajournal.com/premise-health-telecare-corp-enara-health-data-breaches/) — *The HIPAA Journal* Why it matters: A former employee copied patient records for six months. Premise Health, which runs more than 800 workplace health centres in the US, says a former employee copied patient data from 26 March until the theft was found on 18 September, including Social Security numbers, insurance details and diagnosis and treatment information; the employee was fired and police were told, with no misuse found so far. severity medium · EU: GDPR --- ## Defence & National Security [Iran-backed network directed London attacks over FaceTime, US prosecutors say](https://therecord.media/iran-backed-network-directed-london-attacks-over-facetime) — *The Record from Recorded Future News* Why it matters: US prosecutors detail an IRGC-run campaign of attacks in Europe, including a plot on a US bomber base. An unsealed US indictment accuses three men, including an alleged IRGC operative, of directing attacks for Iran's Revolutionary Guards on synagogues in Belgium, the Netherlands and London, US bank buildings in Amsterdam and Paris, and a stabbing in London. The same network allegedly plotted to hit RAF Fairford with vans, steered by phone from Iran and by a defendant jailed in New York through calls with relatives; a London arson was streamed over FaceTime for propaganda. [Bomb threats hit hundreds of schools in Italy, Ireland and UK](https://www.politico.eu/article/bomb-threats-disrupting-hundreds-schools-italy-ireland-uk/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Policy – POLITICO* Why it matters: The hoax-threat wave moves from airports and media to schools. More than 300 Italian schools were evacuated on Wednesday after identical bomb threats, which the education minister called 'most likely a cyberattack'; more than 270 schools in Scotland and over 300 in Northern Ireland were also targeted. Last week's threats to European flights were signed 'Fighters of the Male State', a Russian ultranationalist movement banned in 2021 whose founder denied involvement, ANSA reported. --- ## Quantum & Cryptography [Google DeepMind just mathematically verified key parts of Signal](https://arstechnica.com/ai/2026/11/signals-encryption-just-passed-an-ai-powered-mathematical-checkup/) — *Ars Technica* Why it matters: AI makes formal verification of widely used cryptography faster. Google DeepMind used an agentic AI framework, AlphaProof Code, to formally verify a number of the Signal protocol's key cryptographic guarantees in four weeks, independent validation for the protocol behind Signal, WhatsApp and Google Messages. The work did not cover the whole Signal app, and the researchers say scaling it to most software is still far off. [eMudhra revokes 8 more CA certificates after private key mishap](https://www.bleepingcomputer.com/news/security/emudhra-revokes-8-more-ca-certificates-after-private-key-mishap/) — *BleepingComputer* Why it matters: A certificate authority's key-handling script broke the trust chain for 16 intermediates. eMudhra revoked eight more intermediate CA certificates, used for TLS and code signing, bringing the total to 16: a custom script written in April 2025 to move keys between hardware security modules cut eight ECDSA private keys to a single byte and handled eight RSA keys in host memory outside the HSMs. Some of the revoked RSA intermediates had issued certificates until 3 November. --- ## Digital Sovereignty & Identity [Digital driver’s licence and separate EUDI Wallet “d-you” to launch in Germany](https://identityweek.net/digital-drivers-licence-and-separate-eudi-wallet-d-you-to-launch-in-germany/) — *Identity Week* Why it matters: Germany sets its EUDI wallet start and keeps the driving licence out of it. Germany will put the digital driving licence in its existing i-Kfz app in about four weeks, while the EUDI wallet 'd-you' starts in January 2027 with 40 partners; the cabinet has approved the draft Digital Identities Act. The licence will not be in the wallet, and an EU-wide digital licence is expected by 2030. --- ## Cybersecurity & Threats **\[P2\]** [Poland shuts down government services platform ePUAP following cyberattack](https://therecord.media/poland-shuts-down-government-services-platform-cyberattack) — *The Record from Recorded Future News* Why it matters: An attack forces a Member State's national e-government platform offline. Poland took ePUAP, the national platform for submitting documents and dealing with public authorities, offline as a precaution after detecting and stopping a cyberattack, Digital Affairs Minister Krzysztof Gawkowski said; the Trusted Profile identity service used to sign documents may also be affected. No data theft or attribution has been reported, and there is no restoration date. severity high · EU: NIS2, eIDAS **\[P2\]** [French bank Credit Mutuel Arkea says €100m missing after cyberattack](https://databreaches.net/2026/11/11/french-bank-credit-mutuel-arkea-says-e100m-missing-after-cyberattack/) — *DataBreaches.Net* Why it matters: Criminals steal around €100 million from a mainstream EU bank. Crédit Mutuel Arkéa says hackers used one of the bank's own accounts to make fraudulent transactions worth about €100 million and that it is trying to recover the funds, Reuters reports; the money was not in cryptocurrency but may have been converted afterwards. French prosecutors are investigating. severity high · EU: DORA, NIS2 **\[P2\]** [Active ScreenConnect attacks breach MSPs, impact dozens of organizations](https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/) — *BleepingComputer* Why it matters: A live campaign turns MSPs' remote-access tools against their customers. Huntress is tracking an active campaign against cloud-hosted ScreenConnect instances that has compromised six managed service providers and more than 286 endpoints at 47 organisations: attackers use the Run Command feature to install their own ScreenConnect clients on managed devices, and may be able to pivot back to a technician's workstation. ConnectWise is investigating and tells partners not to open interactive sessions to suspected compromised devices. severity high · exploited in the wild · EU: NIS2 **\[P2\]** [CISA flags Cisco BroadWorks flaw as actively exploited in attacks](https://www.bleepingcomputer.com/news/security/cisa-flags-cisco-broadworks-flaw-as-actively-exploited-in-attacks/) — *BleepingComputer* Why it matters: An AI agent was used to exploit a telecom platform at a European provider. CISA added CVE-2026-20320, an unauthenticated XXE flaw in Cisco BroadWorks that lets attackers read files from the server, and an Openwave Messaging flaw to its KEV catalogue, with a 24 November deadline for federal agencies. Malbear Labs says a Chinese-speaking actor used a jailbroken DeepSeek Flash agent to exploit it at a European telecom provider and 13 organisations using its data centres, recovering the platform's system identity key and other private keys. severity high (CVSS 7.5) · exploited in the wild · `CVE-2026-20320` · EU: NIS2, CRA · actor Unnamed Chinese-speaking actor (30%) **\[P3\]** [Maersk confirms data breach as WhiteArmor ransomware demands $5 million](https://www.bleepingcomputer.com/news/security/maersk-confirms-data-breach-as-whitearmor-ransomware-demands-5-million/) — *BleepingComputer* Why it matters: A ransomware gang claims data from the logistics arm of one of the world's largest container carriers. Maersk says an intruder breached a local system of a company it acquired and stole data, with no sign so far that sensitive data was disclosed and no expected disruption to operations; WhiteArmor claims 100GB from its contract-logistics arm, the former LF Logistics, and demands $5 million within 30 days. severity medium · EU: NIS2 · actor WhiteArmor (60%)