🔍 Read the full analysis: What Went Wrong In AI This Week? Outages, Breaches, And Causes on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
As of 09:40 UTC on Nov. 15, Microsoft attributed its Microsoft 365 outage to a latent bug exposed during network maintenance, while U.S. officials linked an FAA ground stop to a router problem during a contractor’s fiber upgrade. Officials and companies reported no evidence of an attack in either outage, but investigations and written reports remain pending. Five other incidents involved confirmed attacks or compromises, including an exploited Outlook flaw, breached Check Point gateways and vendor-related data exposures.
Microsoft’s Microsoft 365 outage and a nationwide FAA ground stop were attributed to network and maintenance problems, not attacks, according to company status updates and statements from U.S. officials checked Sunday morning. The same week included five separate reported attacks or compromises, underscoring that the disruptions had different known causes even as cybersecurity fears spread.
Microsoft said its service disruption, which affected access to Exchange Online mailboxes and services that rely on them, began Thursday, Nov. 12, and ended Friday. Its explanation changed as the investigation progressed. The company first said it had not identified a recent change linked to the impact, then reported reverting a network configuration change. By Friday, it described the outage as a technical issue unrelated to cyber activity or AI agents. A later status-page edit, recorded by Cloud Admin Hub, attributed the failure to traffic shifts during standard network maintenance and upgrades exposing a latent bug that prevented new connection requests. Microsoft’s edited record moved the reported start time to 16:20 UTC Thursday; it listed the end at 16:10 UTC Friday.
The FAA’s ground stop began at 3:54 p.m. Eastern on Nov. 13 and lasted about four hours and 23 minutes, based on the agency’s advisory times. Transportation Secretary Sean Duffy said a contractor was replacing telecommunications lines at a remote FAA site as part of a copper-to-fiber upgrade. He said a router being replaced began flooding other routers in the air traffic control system, but officials had not determined whether the fault came from contractor error or faulty equipment. The FAA’s public written statement still said technicians were investigating. L3Harris said it was supporting that investigation.
The other five incidents were distinct from the two outages. The source review says Microsoft and CISA listed an Outlook flaw as exploited, and attackers broke into unpatched Check Point gateways. It also reports that Uber driver data was accessed using a vendor’s stolen credentials, Osaka users’ email addresses were exposed through a vendor’s vendor, and three Trezor wallets bought from one reseller contained implants. These incidents involved exploited software, compromised credentials or supply-chain risks; they do not establish a connection to either outage.
The week of November 9 to 15, 2026
Two outages, five attacks, one question
Each incident we covered this week, sorted by what the companies and officials responsible have said so far.
Day by day
- Nov 10Outlook flaw: Microsoft and CISA list it as exploited
Attack - Nov 10Uber notice: a vendor’s stolen credentials were used
Attack - Nov 12Check Point: unpatched gateways broken into
Attack - Nov 12Trezor: implants in wallets bought from one reseller
Attack - Nov 12 to 13Microsoft 365 outage: network maintenance exposed a bug, Microsoft says
Change / maintenance - Nov 13FAA ground stop: router swap during routine work, officials say
Change / maintenance - Nov 13Osaka: email addresses leaked through a vendor’s vendor
Attack - Nov 15Microsoft’s report and a written FAA account: still pending
Open
The tally
AttackConfirmed by the company or agency
Change / maintenanceNo evidence of an attack so far
OpenReports still to come
Sources: Microsoft service health records and status page (Nov 12 to 15); FAA statement and Command Center advisories (Nov 13); Transportation Secretary Sean Duffy and FAA Administrator Bryan Bedford, news conference of Nov 14, as reported by Fox Business, MS NOW and CNN; Microsoft Security Response Center and CISA (Nov 10); Uber notice dated Nov 10; Check Point (Nov 12); Trezor (Nov 12); City of Osaka (Nov 13). Tags are our summary of those statements, as of 09:40 UTC, Nov 15, 2026.
Graphic: Powered by Thorsten Meyer AI
Two Outages, Different Security Risks
Separating the outages from the attacks matters for organizations deciding how to respond. The reported outage causes point to routine changes and maintenance as sources of operational risk: network upgrades can expose latent software faults, and work on telecommunications equipment can affect systems beyond the site being serviced. Those explanations are preliminary, not final findings.
The five reported compromises point to different defensive concerns: patching known flaws, protecting vendor credentials, tracing subcontractors and checking hardware supply chains. Grouping all seven events as evidence of a single cyber incident would go beyond what the cited statements support. At the same time, “no evidence” of an attack is not proof that one has been ruled out. The distinction helps readers and operators avoid both unsupported alarm and premature reassurance.
Popular right now
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
eufy C30 Robot Vacuum and Mop
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, White
As an affiliate, we earn on qualifying purchases.
How the Explanations Changed
Microsoft’s public account developed over several updates between Thursday and Sunday. It initially said there was no known recent change correlated with the outage’s start, then said it was reversing a network configuration change. On Friday, it said there was no indication of malicious activity and characterized the issue as unrelated to cyber or AI. The Sunday status-page wording added a more specific preliminary explanation: maintenance-related traffic shifts exposed a latent bug. The final root-cause report has not yet been published.
The FAA account also became more specific over time. Duffy first blamed old, overloaded telecommunications equipment, then described the contractor’s copper-to-fiber work and a router flooding other routers. FAA Administrator Bryan Bedford said Saturday that officials saw “zero evidence” of anything nefarious and no evidence the incident was AI-related, according to CNN. The FAA’s written notice, however, remained limited to saying technicians were investigating. The review is based on public company and agency statements and attributed media reporting, as of the stated Sunday check.
““Traffic shifts during standard network maintenance and upgrades exposed a latent bug in which our systems were unable to complete new connection requests.””
— Microsoft, in its edited service-health status
Final Root Causes Still Pending
Neither major outage has a final public root-cause report in the source material. Microsoft said it planned to issue a preliminary post-incident report within two business days and a final report within five business days. The FAA’s written account had not gone beyond saying technicians were investigating when checked at 09:37 UTC Sunday. Officials had not determined whether the router fault resulted from contractor error or defective equipment.
The review also does not provide complete supporting details for all five reported compromises, such as the full scope of affected data, the number of people affected, or the status of remediation. The claim that no attack caused either outage reflects the evidence and statements available at the time; it does not mean an attack has been conclusively ruled out. All findings are time-stamped to 09:40 UTC on Nov. 15 and could change as investigations advance.
Reports and Investigations to Follow
Microsoft’s expected preliminary and final reports should clarify how maintenance traffic exposed the bug, what systems were affected and what corrective steps were taken. The FAA investigation is expected to establish how the router disruption began and how it spread through air traffic control communications. No publication date for the FAA’s written findings was included in the available material.
For the other incidents, readers should watch for company, agency or law-enforcement updates that establish the extent of exposure and whether access has been contained. Until those details emerge, the defensible conclusion is limited: the two headline outages have been attributed to technical failures, while the separate reported compromises involved attacks or supply-chain weaknesses.
Key Questions
Were the Microsoft and FAA outages cyberattacks?
Company and official statements reported no evidence of an attack in either outage as of the Sunday morning check. Neither investigation had issued a final report, so that assessment could change.
What caused the Microsoft 365 outage?
Microsoft’s preliminary account says traffic shifts during network maintenance and upgrades exposed a latent bug that stopped systems from completing new connection requests. The company said a final post-incident report was still to come.
What caused the FAA ground stop?
Transportation Secretary Sean Duffy said a router began flooding other routers during a contractor’s copper-to-fiber telecommunications upgrade. Officials had not determined whether contractor error or faulty equipment caused the problem.
Were the other incidents connected to the outages?
The source material describes them as separate incidents. It reports attacks involving an exploited Outlook flaw and unpatched Check Point gateways, plus compromises linked to vendor credentials, a vendor’s vendor and implanted wallet devices. It does not establish a connection to either outage.
What reports are expected next?
Microsoft said it planned a preliminary report within two business days and a final report within five. The FAA was still investigating, and the source material did not give a date for its written findings.
Source: ThorstenMeyerAI.com
