Microsoft 365 spent more than 18 hours broken, Nvidia CEO Jensen Huang resigned, Synology patched a 9.8 login bypass, 35,000 Grok Build apps sat open to anyone who knew where to look, an 8GB cheap mining card turned out to be hiding an A100, and a Kremlin propagandist’s laptop showed how he tried to poison chatbots.
Welcome to Friday. If you spent part of Thursday night refreshing an inbox that wouldn’t load, you’re in good company: a lot of Europe started this morning the same way. It’s a good reminder of how much of a working day now runs through one vendor’s sign-in and routing setup, and how quiet things get when that setup stumbles.
The rest of the week had one thread running through it: things that were supposed to stay locked didn’t. A NAS login turned out to be optional. A “secret” share link sat in public DNS records. A fuse that should only ever tighten restrictions loosened them. And a man who builds fake news sites at industrial scale had his own laptop dumped online, prompts and all. So pour something nice, and let’s go through it.
• Synology DSM, CVE-2026-76954 (CVSS 9.8) and CVE-2026-85101: update to DSM 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10 or 7.2.1-69057-13 or later. There is no workaround.
• Outlook NTLMv2 leak, exploited in the wild: check your Outlook patch status, and treat unexpected message files with suspicion.
• Grok Build: if your team shares Grok Build apps, check who can open them.
In this issue
- Microsoft 365 goes down, and stays down
- Jensen Huang resigns as Nvidia CEO
- Synology’s login was optional
- Grok Build left 35,000 apps open to anyone
- The 8GB mining card that was really an A100
- A Kremlin propagandist’s laptop, prompts included
- Plus five more stories worth your attention
🔴 OUTAGE · MICROSOFT 365
Microsoft 365 goes down, and stays down
It started on Thursday evening with Outlook down worldwide, on the web and in the apps. Microsoft blamed “elevated load across multiple regions,” started restarting servers, and said it was still checking whether the surge was real traffic or a routing change.
Within the hour the outage had spread to Teams, SharePoint, Copilot and even Defender XDR, and TechCrunch reported that consumers couldn’t reach OneDrive or Office on the web either. Microsoft’s own status page failed to load for some users.
Some NHS hospital trusts in Britain have cancelled appointments, including some C-sections. Ambulance crews can't email patient details and Police Scotland can't receive email, the BBC reports.
By Friday morning it had been broken for more than 14 hours. Microsoft said things were steadier after it patched an authentication and routing configuration component, but gave no time for a full fix. It was a bad week for Outlook: attackers were also exploiting an Outlook bug that leaks your NTLMv2 login when you open a booby-trapped message file.
Why it matters: It’s worth having a written plan for the day this happens again, if you didn't already.
📰 NEWS · NVIDIA / NATIONAL SECURITY
Jensen Huang resigns as Nvidia CEO
Nvidia CEO Jensen Huang, who co-founded the company in 1993 and had run it ever since, resigned on Thursday. It came days after he admitted an affair with Alice Huang, a Singapore executive whom US officials allege China recruited to spy on him, and a day after reports of a second affair, with Nvidia's vice president of health care, Kimberly Powell. Nvidia had no publicly named successor; the board says CFO Colette Kress will serve as interim CEO.
In an 8 November email to staff, Huang wrote: "There is no excuse for what I did." The board opened an independent investigation and, at the time, said it had no reason to believe national security or Nvidia's secrets were compromised, and that he would stay on. Hours after he quit, Reuters reported a third relationship, with another Nvidia employee it did not name.
US officials believe Beijing tasked Alice Huang with getting him to lobby for looser limits on AI chip sales to China. Beijing denies it.
Why it matters: The entire world economy is affected by this.
🔴 CRITICAL · SYNOLOGY NAS · CVSS 9.8
Synology’s login was optional
A critical flaw in Synology NAS devices lets attackers read and write any file on them without logging in. CVE-2026-76954 is an SQL injection in the DSM login system, rated 9.8 out of 10. A second bug, CVE-2026-85101, lets attackers skip the login through rsync.
Synology’s advisory lists no workaround, only updates: DSM 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10 or 7.2.1-69057-13 and later. As we noted on X, the fix apparently shipped in October, but Synology only disclosed how bad the bugs were this week.
Why it matters: A lot of home labs and small offices only patch when something sounds scary, so a quiet October update can sit unapplied for weeks. If you have a DiskStation anywhere, especially one reachable from the internet, check the version tonight.
🟠 HIGH · DATA EXPOSURE · GROK BUILD
Grok Build left 35,000 apps open to anyone
Security firm Claroc found that Grok Build left more than 35,000 of its users’ apps open to anyone, including apps from SpaceXSI itself. The open apps held 3,784 workers’ medical exams, a Tesla service-center scorecard naming technicians, a roster for a US Navy contractor, and SpaceXSI’s own sales plans.
The share links use random words to stay unguessable, but those words sit in the subdomain, and passive DNS services record subdomains. Claroc pulled 43,601 grok.me links that way, and nearly 95 percent opened straight into the app. Our follow-up explains how they found them, and why share links from ChatGPT, Claude and Gemini, which keep the secret in the URL path, aren’t exposed the same way. According to Ars Technica, SpaceXSI took down its own 24 apps within hours of being asked about them.
Why it matters: “Anyone with the link” only works if the link stays secret, and DNS was never built to keep secrets. Vibe-coded internal tools are spreading faster than anyone’s review process can keep up. If your team shares AI-built apps, check those sharing settings this weekend.
🔎 RESEARCH · NVIDIA / HARDWARE
The 8GB mining card that was really an 80GB A100
A hacker called Kate says an 8GB Nvidia crypto-mining card hides 80GB of memory, and in her tests the unlocked card beat Nvidia’s A100 AI chip. The CMP 170HX uses the same GA100 chip as the A100, with the extra memory and compute switched off by fuses.
In her write-up she describes building a voltage glitcher that briefly starves the chip of power at just the right moment during boot. That put the fuse controller into a state where she could burn new fuse settings herself. The result: about 120 working compute units instead of the 108 Nvidia ships on retail A100s, and about 1.18 times the A100’s FP16 throughput in her benchmark. She says she told Nvidia’s product security team before publishing, after another researcher independently found the same flaw.
Why it matters: CHEAP DRAM
🔎 INVESTIGATION · DISINFORMATION / AI
A Kremlin propagandist’s laptop, prompts included
Files leaked from the laptop of John Mark Dougan, a US citizen who fled to Moscow and became a Kremlin propagandist, show him using Claude and Qwen to mass-produce 43,000 articles a month. According to NewsGuard’s review of the files, the goal was to flood the web with pro-Russia content so AI chatbots would pick it up and repeat it as fact.
The files also put his running costs at roughly 2 million rubles (about $23,000) a month, and show him asking Qwen how to write text that AI detectors wouldn’t catch. Asked about the leak, Dougan told NewsGuard: “Publish my laptop. I don’t care.”
Why it matters: We usually talk about AI and disinformation as a deepfake problem. This is quieter and probably more durable: write so much plausible text that the models learn your version of events. For anyone building with LLMs, it’s a nudge to care where your retrieval sources come from, not just how good the answers sound.
Also worth your attention
- An open model nearly matches a closed one. DeepSeek’s free, downloadable model came almost as close at hacking as OpenAI’s restricted cyber model in Vals AI’s network-intrusion test, though no model completed the full attack chain.
- The iPhone keyboard’s quiet blocklist. Apple’s iPhone keyboard runs on a hidden list of phrases it won’t suggest, found by researcher Derik Kauffman.
- A game cartridge that jailbreaks the Switch 2. Hackers are breaking into the Nintendo Switch 2 with a Civilization VII cartridge, and 2K is reportedly recalling the physical copies.
- TU Munich portal breached. Hackers stole every registered user’s password from a Technical University of Munich portal, along with names, home addresses and birth dates.
- Defender shared code it shouldn’t have. Microsoft Defender quietly uploaded a developer’s unreleased programs to Microsoft 217 times in three months. Garrett Stimpson found it in Defender’s own logs.
Get the ICD Newsletter
Subscribe for source-forward cyber news, OSINT notes, breach updates, and analysis. Have evidence or a lead? Send it to ICD.
