Microsoft 365 outage, Apache HTTP/2 flaw, GitHub credential theft

November 13, 2026

Microsoft's cloud outage has disrupted email and workplace services, with recovery still underway. Here are the other stories to know today.

The outage began around 18:00 UTC on Nov. 12, when servers started failing automated health checks, disrupting Exchange Online, Teams, Copilot 365 and Defender for Office 365. Microsoft’s alternative health-check method returned a subset of servers to service as recovery continued.

For organizations on Microsoft 365, the disruption can interrupt email, meetings and security workflows at once.

[ www.theregister.com – Articles ]

Google’s fast, everyday-use model scored 51 on the Artificial Analysis Intelligence Index at its default “high” setting, edging out larger Argon’s 50. Hydrogen reaches 54 in “xhigh” mode and costs $1.50 per million input tokens and $7.50 per million output tokens.

For people choosing among Gemini models, a smaller option now leads this benchmark at its default setting.

[ The Decoder ]

Researchers have identified at least 21 affected N-central systems, including 19 running N-able’s latest security update, after Sean Bales released proof-of-concept exploits on Nov. 12. The root-level attack requires Legacy API functionality to be enabled.

N-central admins should check whether Legacy API is enabled and review their exposure.

[ BleepingComputer ]

A race condition in Apache’s mod_http2 can corrupt heap memory, enabling unauthenticated RCE on HTTP Server versions 2.4.55–2.4.70. Wiz found vulnerable resources in 64% of cloud environments, with about half publicly exposed; exploitation requires HTTP/2, which is off by default.

Because Apache is widely used and some vulnerable servers are publicly exposed, admins should check versions and apply the fix.

[ BleepingComputer ]

Tech leaders rallied behind Jensen Huang, with some calling his exit rushed and a “waste” after reports of two affairs, including one with an alleged Chinese spy and another with a direct report. Donald Trump said Apple CEO Tim Cook should replace him.

The reaction puts attention on Nvidia's leadership, whose decisions matter across the tech industry.

[ The Verge ]

Beginning around 12:45 UTC on Nov. 10, attackers used credentials from 4,837 compromised GitHub accounts to probe 61,764 repositories with disguised pull requests. Researchers confirmed secrets were stolen from at least 1,835 targets, while 92% of the PRs remain open.

Teams using GitHub should review open pull requests and rotate any secrets exposed in affected repositories.

[ BleepingComputer ]

OpenAI’s Daybreak Red Team, now in early access, uses AI agents and source code and app context to probe web apps and validate reported vulnerabilities. President Greg Brockman said companies’ security will depend on the frontier models they use and how well they deploy them.

For companies weighing AI security tools, the early-access release raises a practical question: can automated testing find issues their teams miss?

[ www.theregister.com – Articles ]

This article was generated by AI and cites original sources.