> ## Content Index > Fetch the complete content index at: https://www.cyberverso.net/llms.txt > Use this file to discover other available public pages before exploring further. # Cyber / Brief, 13 Nov 2026: Jensen Huang quits Nvidia as Congress moves to tighten chip controls - URL: https://www.cyberverso.net/brief/cyber-brief-13-nov-2026/ - Published: 2026-11-13T09:37:08.000Z - Updated: 2026-11-13T09:37:08.000Z - Description: Jensen Huang resigned as Nvidia's chief executive on Thursday, four days after the board opened an inquiry into his affair with a woman US officials call a Chinese intelligence asset, and the fallout is already reshaping policy: Singapore says Washington gave little help when it… - Author: Paolo De Rosa - Tags: #bulletin, #signal, #en Jensen Huang resigned as Nvidia's chief executive on Thursday, four days after the board opened an inquiry into his affair with a woman US officials call a Chinese intelligence asset, and the fallout is already reshaping policy: Singapore says Washington gave little help when it investigated her company Megaspeed over suspect server shipments, congressional leaders of both parties now back tighter chip export controls in this year's defence bill, and a lawmaker says Nvidia privately conceded that tracking its chips' location is feasible. The EU's leaders hold their first real debate on AI in Dublin the same day, with sovereignty the theme but no agreement on where Europe should catch up, while Brussels sets common rules for AI Act sandboxes and Parliament's rapporteurs want sovereignty tiers for cloud written into law. In security, Unit 42 documents Chinese-speaking operators letting an open-source AI framework run intrusions against chipmakers and defence firms on its own, Enea describes a state-level actor intercepting Taiwanese calls through hijacked Asian telecom operators, and US authorities moved to seize $1.2 billion of the North Korean theft from Binance, as Europol's Operation Endgame took down another tier of the infostealer market. ## Top Stories - [Jensen Huang Resigns as Nvidia CEO](https://www.wired.com/story/nvidia-ceo-jensen-huang-steps-down/) — *WIRED* · AI & Power - [Jensen Huang’s fall further exposes EU leaders on AI](https://www.politico.eu/article/jensen-huang-fall-exposes-eu-leaders-ai-nvidia-european-council/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Technology – POLITICO* · EU & Technology - [Singapore says US authorities, and Supermicro, hardly helped investigation of Jensen Huang’s Chinese friend](https://www.theregister.com/legal/2026/11/13/singapore-says-us-authorities-and-supermicro-hardly-helped-investigation-of-jensen-huangs-chinese-friend/5309579) — *www.theregister.com - Articles* · AI & Power - [Feds announce seizure of $1.2 billion from Binance theft; also takedown of ‘FaceStealer’ tools](https://therecord.media/stolen-binance-crypto-recovered-doj-facestealer-disrupted) — *The Record from Recorded Future News* · Threat Intelligence (CTI) - [Nvidia privately confirmed it could track chips to fight smuggling, even as industry publicly questioned feasibility](https://www.technologyreview.com/2026/11/12/1148483/nvidia-chip-tracking/) — *MIT Technology Review* · AI & Power --- ## AI & Power [Jensen Huang Resigns as Nvidia CEO](https://www.wired.com/story/nvidia-ceo-jensen-huang-steps-down/) — *WIRED* Why it matters: The founder of the company whose chips carry the AI boom, and the industry's loudest voice against export controls, is out. Jensen Huang resigned on Thursday as Nvidia's president, chief executive and board member, with immediate effect, four days after the board opened an investigation into his affair with Alice Huang, whom US officials describe as an asset of China's Ministry of State Security (Beijing rejects the claim). Chief financial officer Colette Kress is interim CEO, and the board will consider internal and external candidates. A source told WIRED that a reported relationship with a subordinate and Huang's dealings with Megaspeed, the Singapore company where Alice Huang held a senior post, weighed more in the board's decision than the espionage allegations. Huang had cultivated Trump to argue against the controls that limit Nvidia's sales to China. [Singapore says US authorities, and Supermicro, hardly helped investigation of Jensen Huang’s Chinese friend](https://www.theregister.com/legal/2026/11/13/singapore-says-us-authorities-and-supermicro-hardly-helped-investigation-of-jensen-huangs-chinese-friend/5309579) — *www.theregister.com - Articles* Why it matters: The first official account of the Megaspeed probe says Washington gave little help in chasing a suspected chip diversion. Singapore's Ministry of Home Affairs says police and customs began investigating Megaspeed in February 2025 over possible false declarations in server purchases, servers bought by local firms and shipped to Malaysia without touching Singapore, and that Alice Huang was not investigated for espionage. Police impounded her passport after a June 2025 visit by the US Bureau of Industry and Security, found in February 2026 too little evidence of the declaration offences, but concluded she had given inaccurate information to play down her role; she was warned and barred from re-entering. The ministry says Supermicro cooperated only in part, and that repeated requests to the Justice Department and the FBI since September 2025 brought little information. [Nvidia privately confirmed it could track chips to fight smuggling, even as industry publicly questioned feasibility](https://www.technologyreview.com/2026/11/12/1148483/nvidia-chip-tracking/) — *MIT Technology Review* Why it matters: Location verification of AI chips moves from 'infeasible' to politically likely once the vendor's own view is known. Representative Bill Foster told MIT Technology Review that Nvidia's representatives privately said the location checks required by the Chip Security Act could be built, although the Semiconductor Industry Association, of which Nvidia is a member, called the mandates untested and potentially infeasible in March. The act is one of three chip-security bills in the Senate's defence authorisation bill; Nvidia's own Fleet Intelligence tool can already show which country chips are in. Foster plans a stricter bill next year that would require a verified licence before an advanced GPU can run. Nvidia did not comment. [Trained to betray: How post-training supply chain attacks hijack coding agents](https://www.microsoft.com/en-us/security/blog/2026/11/12/trained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents/) — *Microsoft Security Blog* Why it matters: Backdoors planted in fine-tuning data or open-weight checkpoints turn coding agents into insiders. Two Microsoft studies, from Defender Research and the AI Red Team, test backdoors planted after pre-training. Poisoning a few fine-tuning examples taught a model to look for any command-execution tool and misuse it when an ordinary request appeared, with about 78% success on familiar agent harnesses and transfer to an unseen one. An adversary controlling the training of an open-weight checkpoint reached 84.1% to 94.8% success on unseen repositories. Microsoft's conclusion is that controls must sit outside the model: on training-data pipelines, on which models are adopted and on what tools agents can reach. [Nonprofits sue Anthropic, Google, and other tech giants to freeze the AI arms race](https://www.politico.com/news/2026/11/12/nonprofits-sue-ai-companies-over-existential-risk-01161965) — *Technology* Why it matters: A court is asked to halt frontier development on public-safety grounds, a test of who can sue over AI risk. A coalition including the Alliance for Secure AI filed suit on Thursday in San Francisco County Superior Court against Anthropic, Google, Meta, OpenAI and SpaceXSI, asking the court to block more advanced models and self-improving AI because their catastrophic risks threaten public safety. The case tests whether groups not directly harmed by an AI company's products can sue over them. Excerpt-based. [OpenAI launches security products, tells orgs they’re doomed if they don’t use them](https://www.theregister.com/security/2026/11/12/openai-launches-security-products-tells-orgs-theyre-doomed-if-they-dont-use-them/5309500) — *www.theregister.com - Articles* Why it matters: The maker of frontier models now sells them as the condition of being secure. OpenAI launched Daybreak Red Team, in early access, in which a fleet of agents tests web applications using their source code, and Daybreak Defense Factory, whose agents on GPT-6 Cyber scan codebases and propose patches that engineers approve. President Greg Brockman said companies will be secure only to the extent of the frontier model they use to defend themselves, while granting that the fundamentals still matter. [GreyNoise AI Cyber Index: Benchmarking AI Models on Defensive Capabilities](https://www.greynoise.io/blog/ai-cyber-index-benchmarking-defensive-capabilities) — *The GreyNoise Blog* Why it matters: A defensive benchmark built on real attack traffic, where most public tests measure offence. GreyNoise launched an index that tests 46 closed and open-weight models on 145 defensive problems drawn from its labelled attack traffic: writing network detections (55% of the score), file detections (30%) and attack forensics (15%). Each answer is run against held-out variants of the same attack, and refusals can be scored as zero, since real malware samples make some models decline the task. The index also reports time and cost. [Google DeepMind Staff Tap the UK Government to Escalate Their Unionization Fight](https://www.wired.com/story/google-deepmind-staff-escalate-their-union-fight/) — *WIRED* Why it matters: A statutory union ballot at a frontier lab began as a protest over military use of AI. The Communication Workers Union and Unite asked the Central Arbitration Committee to confirm they have enough support to trigger a legally binding union ballot for about 1,000 product staff at Google DeepMind in the UK, after talks with management stalled. The push began in February 2025, when Alphabet dropped from its AI principles the pledge not to build weapons. DeepMind says it has acted in good faith. --- ## EU & Technology [Jensen Huang’s fall further exposes EU leaders on AI](https://www.politico.eu/article/jensen-huang-fall-exposes-eu-leaders-ai-nvidia-european-council/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Technology – POLITICO* Why it matters: The EU's leaders hold their first real AI debate as the sector's central company loses its chief. The 27 leaders meet in Dublin on Friday for their first in-depth conversation on AI, the day after Huang's resignation, with presentations by Mistral's Arthur Mensch and Geoffrey Hinton; an EU official said they would mostly listen. António Costa's invitation asks how Europe can become a sovereign player in strategic parts of the AI value chain, but officials disagree on where to catch up, from chips to cloud, and an Italian AI chief warned that moving the dependency from California to France does not solve it. POLITICO notes that EU officials and companies have struggled to get access to the latest OpenAI and Anthropic models. [MEPs create pan-European rules for cloud sovereignty tiers](https://www.rapporteur.com/news/meps-create-pan-european-rules-for-cloud-sovereignty-tiers/) — *Tech | Rapporteur* Why it matters: Parliament's rapporteurs would write sovereignty levels for cloud into EU law. The co-rapporteurs on the Cloud and AI Development Act want pan-European rules for cloud sovereignty tiers and a data security regime centralised inside the act, Rapporteur reports. Only the headline and the standfirst were readable. Excerpt-based. [Commission establishes common rules for AI regulatory sandboxes](https://identityweek.net/commission-establishes-common-rules-for-ai-regulatory-sandboxes/) — *Identity Week* Why it matters: An AI Act implementing act sets one set of rules for national testing environments. The Commission adopted rules under the AI Act for the regulatory sandboxes that national authorities must run: controlled, time-limited settings where providers develop and test AI systems before placing them on the market, under a plan agreed with the authority on timeline, scope, objectives and any real-world testing. The rules aim to end fragmentation between Member States, offer SMEs guidance, and bring in data-protection authorities when personal data is used for training. [Europe’s ageing leaders talk AI – four years late](https://www.rapporteur.com/news/europes-aging-leaders-talk-ai-four-years-late/) — *Tech | Rapporteur* Why it matters: The summit agenda: buy-European rules, private savings for AI and evaluators inside frontier labs. Rapporteur reports that the Dublin debate is squeezed by the Ukraine talks and the EU budget. Leaders will discuss whether governments should be required to buy European technology, as the Commission proposed this year, Finland and Estonia want citizens' savings channelled into AI, and Hungary proposes placing EU safety evaluators inside frontier AI labs. Washington cut foreigners' access to some Anthropic models this year, the outlet notes. [Court-appointed administrators to sound out investors for Nexperia stake amid Wingtech feud](https://www.scmp.com/tech/tech-war/article/3374320/court-appointed-administrators-sound-out-investors-nexperia-stake-amid-wingtech-feud) — *Tech - South China Morning Post* Why it matters: A Dutch court lets the custodians of a Chinese-owned chipmaker look for new owners. Nexperia's two court-appointed administrators will test investor interest in a majority or minority stake, a week after owner Wingtech rejected their plan to cede control of the operations outside China and called it expropriation. The Dutch Enterprise Chamber confirmed they may do so and, in a ruling on Wednesday, found that Wingtech's actions undermined its orders; it told Wingtech and Nexperia China to stop interfering and to withdraw Chinese court claims, including injunctions from a Dongguan court. The administrators say returning control would endanger operations under export controls in several countries. [Brief an Abgeordnete: 28 Organisationen wehren sich gegen Geheimdienstreform](https://netzpolitik.org/2026/brief-an-abgeordnete-28-organisationen-wehren-sich-gegen-geheimdienstreform/) — *netzpolitik.org* Why it matters: Germany votes on an intelligence reform that critics say gives spies police powers and less oversight. Twenty-eight civil-rights groups led by the Humanistische Union asked Bundestag members to vote no on Friday on the government's intelligence reform. They say it erodes the constitutional separation of police and intelligence, gives the BND and the domestic intelligence service police powers, lets the BND act more at home, and widens access to public and private video and biometric matching. They also object to a secret 'special case' the government could declare with the parliamentary oversight panel, allowing deeper intrusions with fewer reporting duties, to the federal data protection commissioner losing most oversight, and to weaker protection for lawyers, journalists and clergy. [France to open international defence AI centre in 2027](https://www.rapporteur.com/news/france-to-open-international-defence-ai-centre-in-2027/) — *Tech | Rapporteur* Why it matters: France builds a coalition for military AI outside NATO's frozen structures. France will open the International Centre for Artificial Intelligence in Defence in Rennes, operational in summer 2027, with a founding conference on 19 and 20 November that more than 20 partner nations are expected to attend. NATO froze new centres of excellence this summer, so Paris will seek accreditation later and work with like-minded allies meanwhile; six have shown informal interest. The centre, with at least 34 staff, will not build AI services but will share practice, set common methods to assess AI reliability and benchmark models. [‘Blind spot’ no longer: Austria targets Russian espionage with new law](https://www.politico.eu/article/austria-targets-russian-espionage-with-new-legislation/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Policy – POLITICO* Why it matters: The host of the UN, the OSCE and the IAEA closes the loophole that made Vienna a hub for spies. The Austrian government approved draft legislation that would make espionage against EU institutions and international organisations based in Austria, such as the UN, the OSCE and the IAEA, punishable by up to five years, and double the maximum for spying on Austria to ten years. It would also criminalise the recruitment of disposable agents and stiffen penalties for some cybercrimes; it is expected to take effect in February 2027\. Austria has expelled eight Russian diplomats since March 2025. [China’s diaspora crackdown reaches deep into Europe, report finds](https://www.politico.eu/article/china-diaspora-crackdown-reaches-deep-into-europe-report-finds/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Policy – POLITICO* Why it matters: A count of Chinese policing outposts lands as EU and Chinese trade officials meet. Safeguard Defenders reports that Beijing oversees nearly 1,250 overseas policing outposts in more than 90 countries, with hundreds across some two dozen European countries, run by more than ten police forces from five provinces through Party operatives abroad, despite Beijing's claim that such stations closed after the NGO's 2022 report. The report was presented at the Inter-Parliamentary Alliance on China as the head of the Commission's trade department met China's vice minister of commerce in Brussels. --- ## US & Technology [‘A high probability’: Congress pushes tighter export controls following Nvidia scandal](https://www.semafor.com/article/11/12/2026/a-high-probability-congress-pushes-tighter-export-controls-following-nvidia-scandal) — *Semafor* Why it matters: The scandal gives chip-control bills a bipartisan path into this year's defence bill. Speaker Mike Johnson and House Democratic leader Hakeem Jeffries both favour tightening chip export controls, and Senate Majority Leader John Thune told Semafor there is a high probability Congress adds restrictions. Three measures, including the Chip Security Act and the MATCH Act on chipmaking equipment, are in the Senate's defence authorisation bill, but there is no deal yet on the final text. Nvidia sold $4 billion of chips to Megaspeed, which the Justice Department is investigating for diversion to China. [Commerce Department Finalizing Long-Awaited AI Remote Access Rule](https://www.theinformation.com/articles/commerce-department-finalizing-long-awaited-ai-remote-access-rule) — *The Information* Why it matters: The rule would close the cloud route Chinese AI firms use to reach controlled chips abroad. The Commerce Department is finalising a rule to stop Chinese AI companies from remotely using advanced AI chips in data centres in other countries, The Information reports, citing two people familiar with the process. The gap matters to EU and Gulf data centres that rent capacity to foreign customers. Excerpt-based. [Don’t put Section 702 spying law renewal in defense bill, groups urge Hill leaders](https://cyberscoop.com/section-702-reauthorization-ndaa-debate/) — *CyberScoop* Why it matters: Warrantless searches of Americans' communications may be renewed without a vote of their own. Twenty-seven groups led by Demand Progress urged congressional leaders not to renew Section 702 of the Foreign Intelligence Surveillance Act through the defence authorisation bill without a warrant requirement for searches on US persons. The law lapsed this summer, but a court has authorised the searches through March; the top House Intelligence Democrat, Jim Himes, wants a renewal in the lame-duck session. --- ## China & Technology [Chinese AI Project Scouts Spies in Taiwan Chip Industry](https://www.darkreading.com/threat-intelligence/chinese-ai-project-scouts-spies-taiwan-chip-industry) — *darkreading* Why it matters: Leaked documents describe AI-driven profiling of Chinese abroad to find influence targets and potential assets. Documents leaked to the watchdog NetAskari, shared with Dark Reading and Sky News, describe a Chinese Communist Party big-data programme that scrapes social media and other public sources and runs machine learning over them to monitor ethnic Chinese abroad, design targeted propaganda and identify people in political and economic circles, the AI industry among them, who might become assets. The claims are NetAskari's reading of the documents. [China’s SMIC sees AI computing crunch until 2028 as Nvidia heat risks tighter chip curbs](https://www.scmp.com/tech/big-tech/article/3374305/chinas-smic-sees-ai-computing-crunch-until-2028-nvidia-heat-risks-tighter-chip-curbs) — *Tech - South China Morning Post* Why it matters: China's largest foundry expects AI compute to stay scarce just as US curbs may tighten. SMIC co-CEO Zhao Haijun said on Friday's earnings call that computing power and supporting chips may stay short until the middle or second half of 2028, as companies across sectors build their own smaller data centres rather than rent tokens at volatile prices. The outlook comes as the scrutiny following Huang's exit threatens tighter US limits on Chinese access to American processors, which could push Chinese buyers further toward domestic foundries. [Alibaba's Qwen3.8 re-educated with a more Western worldview](https://www.theregister.com/ai-and-ml/2026/11/13/alibabas-qwen38-re-educated-with-a-more-western-worldview/5309555) — *www.theregister.com - Articles* Why it matters: The censorship built into China's strongest open models becomes something Western labs train out. Nous Research post-trained Alibaba's open-weight Qwen3.8-27B into a model called Arete to strip what it calls the state-aligned behaviour baked into the weights; a variant tested by The Register refused or gave euphemisms on Tiananmen in 1989\. The Register also cites a Booz Allen Hamilton study finding that some Chinese models write more vulnerable code under certain conditions. --- ## Threat Intelligence (CTI) **\[P2\]** [Feds announce seizure of $1.2 billion from Binance theft; also takedown of ‘FaceStealer’ tools](https://therecord.media/stolen-binance-crypto-recovered-doj-facestealer-disrupted) — *The Record from Recorded Future News* Why it matters: Washington claws back part of a record North Korean crypto theft. The Justice Department obtained court authorisation to seize or restrain more than $1.2 billion of the $6.3 billion stolen from Binance last month, part of $2.7 billion frozen by platforms, and the FBI disrupted North Korean tools including the FaceStealer deepfake scheme. Binance and the FBI attribute the theft to TraderTraitor; Elliptic says the launderers now mint worthless tokens to route funds through decentralised exchange pools. severity high · exploited in the wild · EU: MiCA, AMLR · actor TraderTraitor (North Korea) (85%) **\[P1\]** [Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors](https://unit42.paloaltonetworks.com/cairn-framework-ai-autonomous-attacks/) — *Unit 42* Why it matters: Chinese-speaking operators let an open-source AI framework run intrusions on its own. Unit 42 says Chinese-speaking attackers used Cairn, an open-source AI penetration-testing framework, paired with Zhipu GLM and DeepSeek models, to run 25 operations against at least 19 organisations in semiconductors, defence and civil society in August and September 2026: they gave a target and a one-line goal, and the agents planned and ran each step, gaining access or data at 10. severity high · exploited in the wild · EU: NIS2, AI Act · actor CL-STA-1238 (China-nexus) (50%), escalation **\[P2\]** [Hacked Asian Telcos Used to Intercept Taiwanese Calls and Texts](https://www.infosecurity-magazine.com/news/silentair-liminal-panda-telco/) — *Infosecurity Magazine* Why it matters: A state-level actor turns hijacked operators into an interception platform. Enea says a state-level actor it calls SilentAir has launched SS7 and Diameter attacks from hijacked equipment at operators in at least six Asian countries since early 2025, mostly against Taiwanese subscribers including political and government figures: it intercepted calls and texts, sometimes catching two-factor codes moments after interception began, and sent silent SMS around midnight. Enea also saw Liminal Panda's GTPDoor backdoor at five to ten operators, with a new version hiding in user-plane traffic. severity high · exploited in the wild · EU: NIS2, 5G Toolbox · actor SilentAir (possible China nexus) (30%) **\[P2\]** [Security Agencies Worldwide Found to Use Ad-Based Surveillance System](https://citizenlab.ca/security-agencies-worldwide-found-to-use-ad-based-surveillance-system/) — *The Citizen Lab* Why it matters: Location data bought from ads tracks people for security services, several in the EU. A Bloomberg investigation building on Citizen Lab's research finds that Penlink's Webloc, which tracks phones through advertising data, has customers in the UK, the Netherlands, Germany, Mexico, Singapore, Saudi Arabia, the UAE and Israel, besides the US, El Salvador and Hungary found earlier; Austria's interior ministry is also confirmed. Citizen Lab separately found with high confidence that the rector of the University of Belgrade, a supporter of Serbia's student movement, was hacked with Pegasus in 2026. severity high · exploited in the wild · EU: GDPR, ePrivacy, EMFA **\[P2\]** [Police dismantle Gootloader, CastleRAT, StealC malware infrastructure](https://www.bleepingcomputer.com/news/security/police-dismantles-gootloader-castlerat-stealc-malware-infrastructure/) — *BleepingComputer* Why it matters: Operation Endgame takes down another layer of the infostealer economy. Europol and Eurojust coordinated police from nine countries, including Germany, the Netherlands, Poland and Denmark, to seize 257 domains and 235 servers used by Gootloader, CastleRAT and StealC, and found 6.4 million victim datasets used to resell credentials for further attacks, ransomware included. Victim data is being passed to HaveIBeenPwned and national services. severity high · exploited in the wild · EU: NIS2 --- ## Digital Sovereignty & Identity [EU proposal would make verifiable qualifications portable through EUDI wallets](https://www.biometricupdate.com/202611/eu-proposal-would-make-verifiable-qualifications-portable-through-eudi-wallets) — *Biometric Update* Why it matters: Qualifications become the first mass credential the EUDI Wallet would carry by law. Under the Skills Portability Act, now before the European Parliament, people would receive free digital qualification attestations from public bodies or qualified trust service providers and present them through the EUDI Wallet. Employers could not reject one for being digital or challenge one verified through the framework, revocations would have to propagate across the EU within 24 hours, and after a 36-month transition the attestations would become the default for new qualifications. [The digital yuan is only part of China’s expanding global payments network](https://www.atlanticcouncil.org/blogs/econographics/the-digital-yuan-is-only-part-of-chinas-expanding-global-payments-network/) — *Atlantic Council* Why it matters: Beijing builds several payment layers at once, the e-CNY being the least used. Since January, the People's Bank of China has required banks to pay interest on verified e-CNY wallets, letting them hold the balances as deposits, and has tripled the number of operating banks to thirty, yet retail use stays weak despite about 230 million wallets, the Atlantic Council finds. Beijing has also launched a second cross-border platform alongside mBridge and widened the reach of its CIPS interbank system: several linked layers for partners to join to different degrees. [UK police don’t know how much retrospective facial recognition helps: inspection](https://www.biometricupdate.com/202611/uk-police-dont-know-how-much-retrospective-facial-recognition-helps-inspection) — *Biometric Update* Why it matters: An official inspection finds the law has not kept up with police use of facial recognition. The UK police inspectorate, HMICFRS, reviewed retrospective facial recognition by police forces and the National Crime Agency and made 16 recommendations: the legal framework is fragmented, oversight limited, and use and record-keeping inconsistent, so forces cannot say how much it helps. Searches against the Police National Database have run since 2013; the Home Office plans a law governing police biometrics. --- ## Defence & National Security [Ukraine Says Starshield Disruptions Are Back As U.S. Negotiators Meet With Putin](https://www.twz.com/news-features/ukraine-says-starshield-disruptions-are-back-as-u-s-negotiators-meet-with-putin) — *TWZ* Why it matters: Ukraine's dependence on one US company's satellites becomes leverage in peace talks. For the second time in a month, Ukrainian officials and troops say speed limits on SpaceX's Starshield military service are hampering defence against missile barrages and strikes deep behind the lines, as US negotiators meet Putin; some Ukrainians claim it is pressure to concede territory. SpaceX told TWZ the claim is false and nothing has changed. Kyiv is developing its own satellite communications, which officials admit will not replace the system. [Russian cloud Yandex says drone attacks on its datacenters caused data loss](https://www.theregister.com/off-prem/2026/11/12/russian-cloud-yandex-says-drone-attacks-on-its-datacenters-caused-data-loss/5309234) — *www.theregister.com - Articles* Why it matters: Drone strikes on data centres cost a national cloud provider customer data. Yandex says drone strikes in early October, which Ukrainian media said Kyiv ordered, caused a fire and outage in one availability zone and that 2.84% of customer data was lost because of hardware damage and a lack of backups on the platform; later strikes hit more of its sites. It now enables backups by default and has opened a new zone at an undisclosed location. --- ## Quantum & Cryptography [Collision Attacks on SHA-2: 39-Step SHA-256 below the Birthday Bound](https://eprint.iacr.org/2026/2867) — *Cryptology ePrint Archive* Why it matters: Cryptanalysis of SHA-256 moves one step further, still far from the full function. A new paper estimates that collisions for SHA-256 reduced to 39 of its 64 steps can be found below the 2^128 generic bound, at about 2^108.8 per expected collision with an upper bound of about 2^124.6 for the first, by fixing two expanded message words to the values the characteristic requires. It also cuts the cost for 38 steps from 2^104.3 to 2^90.9\. Full SHA-256 is not threatened. [Quantum leap: IBM plans to scale beyond 1,000 qubits in 2027 with Nighthawk r3 processor](https://www.theregister.com/systems/2026/11/12/quantum-leap-ibm-plans-to-scale-beyond-1000-qubits-in-2027-with-nighthawk-r3-processor/5309357) — *www.theregister.com - Articles* Why it matters: IBM's roadmap toward a fault-tolerant machine in 2029 gets a 2027 milestone. IBM announced the Nighthawk r3 processor for 2027, with 520 qubits and circuits of 10,000 operations, and plans to link two of them into a 1,040-qubit system through chip-to-chip couplers. It keeps the target of Starling in 2029, which it calls the first fault-tolerant quantum computer, with 200 logical qubits running 100 million operations. --- ## Health & Cyber [FDA Flags Cyber, AI Risks in Autonomous Medical Robots](https://health-isac.org/fda-flags-cyber-ai-risks-in-autonomous-medical-robots/) — *Health-ISAC – Health Information Sharing and Analysis Center* Why it matters: Attacks on remote or autonomous surgical robots could harm patients faster than clinicians can react. Regulators and Health-ISAC warn that cyberattacks, AI malfunctions and communication failures in remote or autonomous robotic devices could harm patients during a procedure before clinicians can step in, since the operator-to-device link becomes attack surface for session hijacking, command injection and induced latency. Health-ISAC's Phil Englert calls for cyber-informed clinical risk assessments that map each threat to patient outcomes. The EU read: such robots are medical devices under the MDR and high-risk under the AI Act. **\[P3\]** [Minnesota Epilepsy Group Falls Victim to Second 2026 Cyberattack](https://www.hipaajournal.com/minnesota-epilepsy-group-data-breach/) — *The HIPAA Journal* Why it matters: A specialist epilepsy centre is breached twice in one year. Minnesota Epilepsy Group says an intruder accessed its network on 10 August, exposing data on 82,574 people, including names, Social Security numbers, treatment and insurance information; an earlier breach in March and April affected 80,061\. It is unclear if the two are linked. severity medium · exploited in the wild · EU: GDPR Art. 9, NIS2 --- ## Cybersecurity & Threats **\[P1\]** [Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files](https://thehackernews.com/2026/11/hackers-exploit-php2shell-flaws-in.html) — *The Hacker News* Why it matters: Attackers break into firewalls, then wipe hypervisors in Israel and beyond. An unknown actor exploited the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, in CISA's KEV catalogue since 26 October) in Check Point Mobile Access portals from 30 October, first against Israeli organisations and on 2 November more widely, then escalated to root through a newly disclosed Gaia OS flaw (CVE-2026-123039, CVSS 7.8) to install the TSGA backdoor. In some cases it moved to VMware ESXi hosts over SSH and ran a wiper, leaving politically themed notes, Check Point says. severity critical (CVSS 7.8) · exploited in the wild · EPSS 0.99999 · `CVE-2026-109618` · EU: NIS2, CRA **\[P1\]** [Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2](https://thehackernews.com/2026/11/hackers-exploit-n-central-flaws-to.html) — *The Hacker News* Why it matters: A remote-management platform used by MSPs is exploited even on patched versions. Attackers are exploiting 4EverAble2Shell, an unauthenticated chain in N-able N-central that abuses the bundled Apache Axis component (CVE-2026-90436, CVSS 9.8) and a privilege escalation to run commands as root, hours after a proof of concept was published; it works on current versions, and miners have been installed on exposed servers. N-able has restricted some features and integrations while it prepares further fixes. severity critical (CVSS 9.8) · exploited in the wild · EPSS 0.011 · `CVE-2026-90436` · EU: NIS2 **\[P2\]** [Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories](https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html) — *The Hacker News* Why it matters: Stolen developer accounts plant a CI secret stealer across thousands of repositories. From Tuesday an attacker used stolen credentials for 4,837 GitHub accounts to test write access in 61,764 repositories and to plant a stealer that ran in at least 1,806, taking the secrets and cloud credentials their CI workflows can reach, Aikido Security says; SafeDep counts 8,093 public repositories with malicious commits, 771 of them through an npm postinstall hook that also runs on developers' machines. The attacker usually reverted the change within minutes and deleted the logs. severity high · exploited in the wild · EU: CRA, NIS2 **\[P2\]** [Massive Microsoft 365 outage disrupts Outlook, Teams, Copilot worldwide](https://www.bleepingcomputer.com/news/microsoft/massive-microsoft-365-outage-disrupts-outlook-teams-copilot-worldwide/) — *BleepingComputer* Why it matters: A failure at one provider shuts down email and collaboration for much of the world. A Microsoft 365 outage that began on Thursday afternoon (US Eastern time) cut access worldwide to Exchange Online, Teams, SharePoint, Copilot and Defender XDR, and stretched past twelve hours; Microsoft says a number of servers became unexpectedly unavailable, straining the rest, paused deployments and looked at reverting recent configuration changes. No attack has been reported. severity high · EU: NIS2, DORA **\[P2\]** [Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely](https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html) — *The Hacker News* Why it matters: A remote code execution flaw in the most deployed web server, where HTTP/2 is on. A race condition in Apache HTTP Server's mod\_http2 (CVE-2026-119618, CVSS 9.8) lets an unauthenticated attacker run code on servers with HTTP/2 enabled, versions 2.4.55 to 2.4.70; 2.4.71 fixes it. Red Hat says public research shows a reliable exploit in the default configuration with the module on, while Wiz reported no public exploit and no exploitation. severity high (CVSS 9.8) · EPSS 0.004 · `CVE-2026-119618` · EU: CRA, NIS2 **\[P2\]** [New Windows SignDrop zero-day gives hackers SYSTEM privileges](https://www.bleepingcomputer.com/news/security/new-windows-signdrop-zero-day-gives-hackers-system-privileges/) — *BleepingComputer* Why it matters: An unpatched exploit turns a Microsoft mitigation into a path to SYSTEM and past antivirus self-protection. Researcher Abdelhamid Naceri (Nightmare Eclipse) published SignDrop, a Windows exploit that abuses the authentication files Microsoft added to the Common Log File System driver in October 2025: by forcing a privileged process such as Defender to open a log file, an attacker gets a file created with SYSTEM rights, which also defeats security products' tamper protection. He tested it on Windows 11 26H2 and Windows Server 2025 builds and estimates 80% of installations are exposed; no patch exists. severity high · EU: NIS2