A patchwork of problems.

Patch Tuesday. Maersk investigates a legacy system breach. A chip-smuggling probe stalls after Nvidia reaches out to Commerce. A US Army officer is arrested in the UK for alleged Russian espionage. Kazakhstan-linked hackers deploy AI agents across Central Asia. Opsec blunders unmask an alleged Qilin ransomware boss. Researchers hijack connected cars via Android apps. Our guest is Tim Starks from CyberScoop to discuss what Democratic control of Congress means for cybersecurity. A New Jersey township holds the news until after the votes.

Today is Thursday November 12th 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

Patch Tuesday. 

In honor of the Veterans Day holiday here in the U.S. we did not publish yesterday, which means we are playing a bit of catch up for this month’s patch Tuesday. 

Several major technology vendors have rolled out extensive November security updates, including a fix for an actively exploited zero-day in Microsoft Outlook.

According to SecurityWeek, Redmond addressed one thousand ninety-four vulnerabilities this month. Most notably, CVE-2026-124194 is an exploited Outlook spoofing flaw that leaks a user's NTLMv2 authentication hash if they open a malicious message file, allowing attackers to impersonate them. Windows accounted for seven hundred twenty-six of Microsoft's patches, alongside one hundred seventy-four for Office.

Meanwhile, Fortinet published eighty-nine advisories resolving nearly one hundred flaws, including roughly seventeen critical issues across products like FortiMail, FortiOS, and FortiClient, which researchers note were discovered with the help of frontier artificial intelligence models. Ivanti and Citrix patched nineteen vulnerabilities combined; Ivanti's fixes address critical unauthenticated remote code execution and authentication bypass defects in Endpoint Manager and Cloud Services Application, while Citrix resolved six XenServer flaws and mitigated AMD processor issues. Finally, Zoom patched two unauthenticated privilege escalation vulnerabilities in Workplace for Windows, and Asus addressed four router firmware bugs.

Attackers rapidly weaponize edge devices and collaboration tools, requiring security teams to prioritize patching Outlook and internet-facing enterprise infrastructure immediately, even where active exploitation has not yet been reported, according to vendor advisories.

Maersk investigates isolated security incident on legacy system.

Shipping giant A.P. Moller-Maersk is investigating a security incident involving potential data theft from an isolated legacy system.

In a Wednesday statement, the Denmark-based logistics firm confirmed it secured the affected platform, a local system from a previous acquisition. Maersk said initial findings strongly suggest no sensitive information was disclosed, and there is no evidence of impact on core operations or customer integrations like APIs and electronic data interchange.

Any cyber incident at Maersk recalls the devastating two thousand seventeen NotPetya attack, attributed to Russia's Sandworm group, which cost the firm roughly three hundred million dollars. While this localized intrusion appears far less severe, it highlights persistent cybersecurity risks within inherited acquisition infrastructure, according to Maersk and reporting from The Register.

The Commerce Department halted a chip-smuggling probe after Nvidia outreach. 

Federal investigators at the Commerce Department abruptly paused a monthslong probe into suspected artificial intelligence chip smuggling to China late last year after receiving unusual outreach from Nvidia.

According to The New York Times, the inquiry focused on Singapore-based Megaspeed, led by Alice Huang, whom US intelligence officials now believe spied for Beijing and who had an acknowledged intimate relationship with Nvidia chief executive Jensen Huang. The case was hastily transferred to the Justice Department after Nvidia general counsel Tim Teter emailed investigators, claiming Commerce official Jeff Kessler authorized the company to inquire about the probe.

The episode highlights growing tension between national security enforcement and corporate influence over semiconductor export controls, raising concerns among officials that executive intervention could compromise federal investigations into illicit technology transfers.

Nvidia shares fell ten percent after CEO Jensen Huang resigned today, naming CFO Colette Kress interim chief executive.

The Wall Street Journal reports the board met following a New York Times report alleging a second affair with executive Kimberly Powell. 

A US Army officer is arrested in the UK on suspicion of spying for Russia. 

British police have arrested a forty-one-year-old US Army lieutenant colonel on suspicion of attempting to steal secret information from a NATO installation for Russia.

According to The Washington Post, the unnamed officer was stationed at Imjin Barracks in Gloucestershire, England, which houses NATO's Allied Rapid Reaction Corps. A joint counterintelligence operation involving Britain's MI5, Metropolitan Police, and the FBI detained the officer before any sensitive files were transferred to Moscow. Kremlin spokesman Dmitry Peskov denied any Russian link to the incident.

US Army Counterintelligence Command noted the arrest is a sobering reminder of persistent insider threats within allied defense infrastructure, as Western nations navigate heightened Russian hybrid operations across Europe alongside ongoing Ukraine peace negotiations.

Suspected Kazakhstan-linked hackers deploy AI agents in Central Asian espionage. 

Suspected Kazakhstan-linked hackers used an autonomous artificial intelligence agent to conduct cyberespionage against Central Asian governments and critical infrastructure, according to Singapore-based cybersecurity firm CloudSEK.

Researchers uncovered the operation on an exposed server belonging to Silent Lynx, also tracked as Cavalry Werewolf and YoroTrooper. The operator configured an open-source AI agent named Hermes, powered primarily by DeepSeek models, to act as an offensive security specialist. Controlled remotely via a Telegram bot in Russian, the agent automated reconnaissance, data theft, and log erasure.

Using compromised railway credentials, the attackers breached Tajikistan's national electronic document platform, stealing thousands of files linked to the Defense Ministry and security agencies. They also compromised a server supporting Uzbekistan's Smart Forestry initiative and prepared phishing lures targeting Turkmenistan.

The discovery underscores how threat actors are operationalizing agentic AI to automate complex intrusions, lowering the operational friction required to pillage government networks.

Operational security missteps expose an alleged Qilin ransomware administrator. 

Operational security mistakes over the past decade have exposed the alleged real-world identity of the administrator behind Qilin, currently the world's most active ransomware affiliate program.

According to KrebsOnSecurity, Qilin, which claimed at least three hundred sixty-five victims in the past three months, is led by a threat actor using the handle "Haise." Threat intelligence firms IntelHawk, Intel 471, and Flashpoint traced Haise back to older cybercrime forum monikers, including "Rjun," and a Telegram account tied to an email address exposed in a late two thousand twenty-five breach of Russia's state services portal, Gosuslugi. Those records, alongside leaked travel and education data, point to thirty-six-year-old Aleksey Mikhailovich Yakovtsev of St. Petersburg.

The attribution demonstrates how even sophisticated ransomware operators leave persistent digital breadcrumbs across seized forums and breached databases, aiding defenders and law enforcement in piercing criminal anonymity.

Security researchers exploit Android apps to remotely control connected cars. 

Security researchers uncovered critical flaws in Android applications from two major automakers that enabled remote access to connected vehicles in the United States and Australia.

According to research published by Assetnote co-founder Shubham Shah and Sam Curry, the exploit chains targeted weaknesses in the manufacturers' ForgeRock identity platforms. In Australia, hardcoded staging credentials and path traversal flaws allowed account takeovers using just a license plate lookup. In the US, path confusion and factory default credentials on an Apache Felix console yielded shell access to identity servers, letting the pair start engines, flash headlights, and sound horns. The unnamed automakers, widely speculated by observers to be Toyota and Lexus, patched the vulnerabilities within two hours of disclosure earlier this year.

The findings underscore how backend identity misconfigurations and hardcoded credentials in connected vehicle ecosystems can turn everyday mobile apps into remote-control attack vectors.

A New Jersey township holds the news until after the votes. 

Officials in Cranbury, New Jersey, intended to buy land for affordable housing, though they inadvertently subsidized some ambitious cybercriminals instead, wiring twenty-six million dollars straight into fraudsters' hands.

According to The Wall Street Journal, police expect to recover seventeen point three million dollars, leaving roughly nine million missing, an amount comfortably exceeding the township's five-million-dollar insurance policy. Adding salt to the fiscal wound, officials waited until the Friday afternoon after Election Day to announce the heist. While the police chief took responsibility, explaining a gag order prevented thieves from liquidating the stolen funds, residents packed a town meeting expressing skepticism over the timing and marveling that an eight-figure transfer proved easier than logging into an iCloud account.

The episode offers a sobering reminder that business email compromise doesn't spare small municipalities, and that delayed breach disclosures rarely play well with voters, even when investigators have sound operational reasons.

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

 

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

 

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.