Cyber Brief: Outages, Exploits, and Phishing Traps

Today's stories reflect a theme that runs through much of modern security practice: the gap between assumed resilience and tested resilience. From a global Microsoft outage disrupting everyday business tools to a zero-day in widely used managed service provider software being exploited within hours of public disclosure, the week has offered a timely reminder that both technical dependencies and response readiness deserve regular scrutiny. Alongside these developments, a new NCSC scheme for testing cyber defences and a detailed account of a Teams-based phishing attack provide practical context for UK organisations thinking about where their own gaps might lie.

Microsoft Global Outage Disrupts Teams, Outlook and Copilot for Business Users

A significant Microsoft outage affecting business and enterprise customers began on Thursday 12 November and continued into Friday 13 November 2026, with the BBC reporting that services including Teams, Outlook and AI software Copilot were experiencing connectivity problems. Microsoft described the issue as relating to "elevated loads" and confirmed that the outage was not caused by a cyber security incident. Despite ongoing efforts, the company was struggling to restore full service, with Wired reporting that the disruption was leaving business customers unable to use core email and collaboration tools. The outage affected users across multiple regions, with no confirmed resolution timeframe at the time of publication.

For UK organisations, this outage is a practical demonstration of the operational risk that comes with deep dependency on a single cloud productivity platform. Many businesses have consolidated their communication, collaboration, document management and AI tooling within the Microsoft 365 ecosystem, which means a platform-level disruption can simultaneously affect email, meetings, file sharing and automated workflows. This is not a criticism of Microsoft's platform — cloud services offer genuine resilience benefits — but it does highlight the importance of understanding what your organisation cannot do when a core platform is unavailable, and whether your teams have any fallback arrangements in place.

Why it matters

For UK businesses, this is a prompt to review your business continuity arrangements around cloud platform dependencies. Consider whether your organisation has documented fallback communication options, whether critical processes rely solely on Microsoft services, and whether your staff know what to do if Teams or Outlook becomes unavailable for an extended period. Dependency mapping and continuity planning for SaaS platforms is increasingly a board-level concern.

Source: BBC Technology

N-central Zero-Day Exploited Within Hours of Proof-of-Concept Publication

Security researchers disclosed a new zero-day vulnerability in N-able's N-central remote monitoring and management platform, tracked as part of a set of flaws dubbed 4EverAble2Shell and Agent2Shell. According to SecurityWeek, the flaw could allow remote, unauthenticated attackers to execute code with root privileges, and active exploitation was observed within hours of a proof-of-concept being made public. The Hacker News reported that N-able confirmed 21 servers had been compromised, including 19 running a hotfix that had been issued in response to the initial disclosure. N-able said it was restricting certain N-central features and integrations as a precautionary measure while remediation work continued.

N-central is used by managed service providers (MSPs) to remotely monitor and manage their clients' IT environments, which means vulnerabilities in the platform carry supply chain risk. A compromised MSP tool does not just affect the MSP itself — it can provide attackers with privileged access to the systems of every organisation that MSP supports. The speed of exploitation here, within hours of public disclosure, reflects a pattern that security teams are increasingly having to contend with: the window between vulnerability publication and active attack is shrinking, and organisations relying on MSPs need confidence that their providers are monitoring and responding to these developments promptly.

Why it matters

For UK organisations that use managed service providers, this is a prompt to ask your MSP directly whether they use N-central, whether they have applied the latest patches or mitigations, and what their process is for responding to zero-day disclosures in the tools they use to manage your environment. Understanding your MSP's patch management and incident response practices is a reasonable and important part of supplier due diligence.

Source: SecurityWeek

Teams Meeting Invite Used to Deliver Device Code Phishing Attack

Help Net Security has reported on an incident in which attackers used a fake Microsoft Teams meeting scheduler to trick an employee at a construction company into completing a device code sign-in. The attacker initiated a legitimate Microsoft sign-in flow, obtained a short device code, and then persuaded the victim to enter it into Microsoft's genuine device login page. Because the victim completed multi-factor authentication as part of this process, the attacker received a valid session token — effectively bypassing MFA without needing the victim's password. The incident was identified by Huntress's security operations centre before significant damage occurred, but the attacker had already obtained authenticated access to the target's Microsoft environment.

Device code phishing is a technique that exploits a real and legitimate Microsoft authentication flow, which makes it particularly difficult for users to identify as suspicious. The victim in this case completed what appeared to be a normal MFA prompt, unaware that they were authorising access for an attacker rather than themselves. This type of attack is increasingly being used against organisations that have deployed MFA, because it sidesteps the protection MFA is intended to provide. The construction sector context is also worth noting — professional services and project-based industries are frequently targeted because of the volume of external collaboration and meeting invitations their staff receive, making a fake scheduling link a plausible lure.

Why it matters

For UK businesses, this is a prompt to review whether your security awareness training covers device code phishing specifically, and whether your staff understand that completing an MFA prompt does not always mean they are authenticating safely. It is also worth reviewing whether your Microsoft tenant has Conditional Access policies in place that restrict device code authentication flows, as Microsoft provides controls that can limit exposure to this technique.

Source: Help Net Security

NCSC Launches Cyber Adversary Simulation Scheme for Critical Organisations

The National Cyber Security Centre has announced a new Cyber Adversary Simulation scheme designed to help critical organisations test their cyber defences through rigorous, real-world simulation exercises delivered by trusted providers. The scheme, announced on Wednesday 11 November 2026, is intended to give organisations operating in critical sectors access to structured, high-quality adversary simulation testing that reflects the tactics, techniques and procedures used by real-world threat actors. The NCSC has positioned the scheme as a way to help organisations move beyond theoretical security assessments and understand how their defences would perform under realistic attack conditions.

For UK organisations in critical sectors — including healthcare, energy, finance, transport and local government — this scheme represents a meaningful step forward in the quality and consistency of security testing available to them. Adversary simulation, sometimes referred to as red teaming, goes beyond standard penetration testing by replicating the behaviour of sophisticated threat actors over an extended period, testing not just technical controls but also detection capabilities, incident response processes and human decision-making under pressure. The NCSC's involvement in approving and overseeing providers adds a layer of assurance that is particularly valuable for organisations that may not have the in-house expertise to evaluate the quality of simulation providers independently.

Why it matters

For UK organisations in or adjacent to critical sectors, this is a prompt to review whether your current security testing programme reflects the realistic threat landscape you face, or whether it is primarily focused on compliance requirements. The NCSC scheme provides a structured route to more meaningful resilience testing, and understanding whether your organisation qualifies or could benefit from adversary simulation is a worthwhile conversation to have with your security leadership team.

Source: NCSC UK

Today's Key Actions

• Review your organisation's business continuity arrangements for Microsoft 365 dependencies — document what fallback communication and collaboration options exist if Teams or Outlook becomes unavailable for an extended period.
• If your organisation uses a managed service provider, ask them directly whether they use N-central, confirm they have applied current patches or mitigations for the 4EverAble2Shell and Agent2Shell vulnerabilities, and review their process for responding to zero-day disclosures in their tooling.
• Review whether your security awareness training covers device code phishing, and assess whether your Microsoft tenant has Conditional Access policies in place to restrict or monitor device code authentication flows.
• If your organisation operates in or adjacent to a critical sector, review whether your current security testing programme includes realistic adversary simulation, and consider whether the NCSC's new Cyber Adversary Simulation scheme is relevant to your resilience planning.
• Ensure that ownership of these areas — cloud resilience, MSP oversight, identity security controls and security testing — is clearly assigned within your organisation, with named individuals responsible for reviewing and acting on each point.

Secarma Insight

This week's stories share a common thread: the difference between security that looks adequate on paper and security that holds up under realistic conditions. Whether that means testing how your defences respond to a simulated adversary, understanding what happens to your business when a cloud platform goes down, or ensuring your staff can recognise a phishing technique that deliberately mimics a legitimate process, the underlying discipline is the same — knowing your environment, testing your assumptions, and making sure the right people own the right responsibilities. Good security practice is not about reacting to every new development with urgency; it is about building habits, processes and oversight structures that are already functioning before an incident occurs. Organisations that invest in that kind of practical, tested resilience are consistently better placed to respond calmly and effectively when something unexpected happens.