Daily brief, Friday 13 November
Everything that broke in the last 48 hours
CISA added nothing new to its list of flaws exploited in the wild and 40 malicious packages were published to open-source registries. 3 countries had a connectivity drop still in progress.
Built from the live feeds at 09:50 UTC, 13 Nov 2026.
Organisations named in incidents in 4 countries, last 48 hours
- Confirmed
- 8
- Reported
- 21
- Claimed
- 36
Organisations named in incidents
8Reported:Hustler: reported cyberattack, not yet confirmed
Hustler: cyberattack reported. Unknown, 13 Nov 2026.
What to do
Follow updates from the organisation itself rather than social media.
Reported:Our Second Nature: reported data breach, not yet confirmed
Our Second Nature: data breach reported. Unknown, 13 Nov 2026.
What to do
If you have an account, change that password, and anywhere you reused it.
Reported:Microsoft Global: reported cyberattack, not yet confirmed
Microsoft Global: cyberattack reported. Unknown, 13 Nov 2026.
What to do
Follow updates from the organisation itself rather than social media.
Reported:Burger King Japan: reported data breach, not yet confirmed
Burger King Japan: data breach reported. Unknown, 13 Nov 2026.
What to do
If you have an account, change that password, and anywhere you reused it.
Reported:Is Microsoft Outlook Outage: reported cyberattack, not yet confirmed
Is Microsoft Outlook Outage: cyberattack reported. Unknown, 13 Nov 2026.
What to do
Follow updates from the organisation itself rather than social media.
Reported:Caixa Seguridade Unit: reported data breach, not yet confirmed
Caixa Seguridade Unit: data breach reported. Unknown, 12 Nov 2026.
What to do
If you have an account, change that password, and anywhere you reused it.
Reported:Premise Health Insider: reported data breach, not yet confirmed
Premise Health Insider: data breach reported. Unknown, 12 Nov 2026.
What to do
If you have an account, change that password, and anywhere you reused it.
Claimed on leak sites
12 of 36 shown- Claimed:cey-tech.comKrybit · Unknown · 13 Nov 2026Full dossier
- Claimed:Maersk ProbesA ransomware group · Unknown · 11 Nov 2026Full dossier
- Claimed:Leware Construction Company ofFloridaAkira · Unknown · 11 Nov 2026Full dossier
- Claimed:R3 CompositesAkira · Unknown · 11 Nov 2026Full dossier
- Claimed:Quality AirAkira · Unknown · 11 Nov 2026Full dossier
- Claimed:KadickDeadlock · Unknown · 11 Nov 2026Full dossier
- Claimed:EiCOhThe Gentlemen · Unknown · 11 Nov 2026Full dossier
- Claimed:VinsonThe Gentlemen · Unknown · 11 Nov 2026Full dossier
- Claimed:lifelinescreening.comCurious Worm · Unknown · 11 Nov 2026Full dossier
- Claimed:sacheminc.comCurious Worm · United States · 11 Nov 2026Full dossier
- Claimed:sbhny.orgCurious Worm · United States · 11 Nov 2026Full dossier
- Claimed:raleighortho.comCurious Worm · Unknown · 11 Nov 2026Full dossier
Exploited and in the news
1Confirmed:CVE-2026-102895 in pip gpustack: exploited in the wild, on CISA's list since 9 Nov 2026
GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin US federal agencies must fix it by 12 Nov 2026.
Malicious packages
5 of 40 shownWhat to do
If one is in a lockfile, treat that machine as compromised and rotate its secrets.
Malicious npm package: karma365-mcp
Malware in karma365-mcp. Published 13 Nov 2026.
Malicious npm package: @rclaude/darwin-arm64
Malware in @rclaude/darwin-arm64. Published 13 Nov 2026.
Malicious npm package: @wanzforme/bails4u
Malicious code in @wanzforme/bails4u (npm). Published 13 Nov 2026.
Malicious npm package: zxcvb90-utils-helper
Malicious code in zxcvb90-utils-helper (npm). Published 13 Nov 2026.
Malicious npm package: quickgreet
Malicious code in quickgreet (npm). Published 13 Nov 2026.
Connectivity drops
3Connectivity drop in China
Measured by IODA from 12 Nov 2026, 14:00 UTC, and still in progress. The cause is not known unless a source says so.
Connectivity drop in Norfolk Island
Measured by IODA from 13 Nov 2026, 00:30 UTC, and still in progress. The cause is not known unless a source says so.
Connectivity drop in Aland Islands
Measured by IODA from 13 Nov 2026, 02:30 UTC, and still in progress. The cause is not known unless a source says so.
Leak-site claims tracked by RansomLook (ransomlook.io), CC BY 4.0, enriched by Black Shard. Data security breach notices from the California Department of Justice. Security breach notices from the Vermont Attorney General. Media coverage indexed by the GDELT Project (gdeltproject.org).
Updated 13 Nov 2026, 09:50 UTC, 33 of 36 sources answering.
Under attack? Call the incident line.
Black Shard's team can check your exposure, take a fix off your plate or step in on a live incident.