Uros Svete

ex Director Government Information Security Office (URSIV) ; Defense Studies, Assist. Prof at Faculty of Social Sciences,Lj; cyber and national security

[Florian Roth ⚡️ @cyb3rops]

Ping me if you want to run a compromise assessment after a day without EDR visibility

[Uros Svete @worldeu]

Izpad MS storitev je poleg vpliva na storitve tudi varnostni problem, zlasti za tiste SOC-e, ki uporabljajo Microsoft Defender XDR (oblak). EDR lahko še vedno zazna napade na končnih napravah, medtem ko je centralna vidnost dogodkov oziroma možnost odzivanja prek oblaka omejena.

[Troy Hunt @troyhunt]

Having this outage with M365 reminds you how critical email still is. It's not just about not knowing who has emailed me or whether my sent emails have been received, I'm now locked out of a bunch of services that use email for login. It's a massive business disruption.

[International Cyber Digest @IntCyberDigest]

‼️ UPDATE: Microsoft's outage now reaches far beyond Outlook. Teams, SharePoint, Copilot and even its Defender XDR security platform are hit.

Consumers can't reach their OneDrive storage or Office on the web either, TechCrunch reports.

Microsoft first blamed elevated load. Now it says a large number of its servers became unexpectedly unavailable, dumping their load onto the rest. It hasn't said why.

It is restarting the servers with a fix in place, investigating why they show high processor use, and has paused all deployments.

[Uros Svete @worldeu]

Nekoc smo imeli vojasko in komercialno tehnologijo, danes imamo samo se komercialno. Posledice so tu https://t.co/O1E1zHr9Ic

[Uros Svete @worldeu]

Kibernetska atribucija je zapletena rec. Konsenz je tezko dosec celo med institucijami znotraj drzave, kaj sele na mednarodni ravni

[International Cyber Digest @IntCyberDigest]

Belgium's government can't agree on who hacked its supermarket freezers. The interior minister pointed at Iran and asked Defence to consider a military cyber response.

Hours later, the foreign minister's office told Belgian outlet HLN the evidence is not enough to officially blame Iran. No decision has been made on summoning Iran's ambassador.

Earlier this month, hackers remotely switched freezers in dozens of Belgian stores to defrost, some set to 50°C.

[Digital EU 🇪🇺 @DigitalEU]

Cyber threats are a growing concern for everyone.

Together with @NATO, we have reflected on several developments on both sides and explored further avenues to strengthen the respective cyber defence mechanisms.

Read more about the Cyber Dialogue: https://t.co/VMo7Bon05B

[Coffe Report @CoffeReport]

🇵🇱 NEW: POLAND SHUTS DOWN NATIONAL E-GOVERNMENT PLATFORM FOLLOWING CYBERATTACK

Poland has temporarily taken its nationwide e-government platform, ePUAP, offline after detecting and stopping a cyberattack on November 10.

Deputy Prime Minister and Digital Affairs Minister Krzysztof Gawkowski confirmed the incident.

• The platform enables citizens and businesses to submit official documents, communicate with government agencies and access public services.

• Polish cybersecurity teams detected and stopped the attack, with authorities subsequently shutting down the platform as a precaution.

• Poland's Internal Security Agency (ABW) has joined the investigation.

• The government says its central IT infrastructure remains secure, with no confirmed system compromise or data theft.

• As of Wednesday afternoon, authorities had not announced when full functionality would be restored.

The identity of the attackers and the method used remain unknown.

[Reuters @Reuters]

Romanian intelligence agency says it identified Russian-linked cyber attack https://t.co/0v6ASBTNOa

[The Hacker News @TheHackersNews]

⚠️ Attackers are exploiting vulnerabilities before they're publicly disclosed.

Mandiant reports a median 7-day lead over disclosure. Enterprises take 20 days on average to deploy patches.
That's a 27-day gap traditional patching can't close.

How runtime defenses help ↓ https://t.co/cvDDvDHh5Y

[BleepingComputer @BleepinComputer]

‼️‼️ Microsoft’s November 2026 Patch Tuesday fixes a massive 1,235 vulnerabilities, including 66 rated Critical and an actively exploited Microsoft Outlook zero-day.

The Outlook flaw (CVE-2026-124194) can be exploited using malicious message files that trick Windows into connecting to attacker-controlled network locations, leaking NTLMv2 authentication hashes that could be used to impersonate victims.

Of the 66 Critical flaws, 48 are remote code execution vulnerabilities, 15 are privilege escalation flaws, and three are use-after-free bugs in Microsoft Edge.

The massive update follows October's record-breaking 1,411 vulnerabilities.

➡️Full details: https://t.co/c2NE6TQtwN

[Uros Svete @worldeu]

Eden od ranljivih sistemov tudi pri nas?

[The Shadowserver Foundation @Shadowserver]

Refrigeration incidents: We still track around 170 Danfoss AK-SM8xxA Series CVE-2025-41452/CVE-2025-41451 vulnerable instances & 136 CVE-2025-41450 in our Vulnerable HTTP reporting: https://t.co/qxv0Gv6cAK

World Map view: https://t.co/HFQkYDicBb

[CERT-FR @CERT_FR]

Les membres du Centre de Coordination des Crises Cyber (C4) ont observé des attaques à but de sabotage et de déstabilisation contre des intérêts français menées par des unités cyber offensives du CGRI.

https://t.co/MMG2XyldGd

[MacRumors.com @MacRumors]

Apple Releases iOS 27.2.1 With Bug Fixes https://t.co/IK9Tp9dVHV

[Uros Svete @worldeu]

Kibernetski napad na hladilne sisteme v Nemciji preiskujejo tudi obvescevalno varnostne sluzbe in njihov skupni center za hibridne groznje

[International Cyber Digest @IntCyberDigest]

‼️ UPDATE: Germany's spy agencies are now on the hackers who heated supermarket freezers to 50°C and spoiled food in hundreds of European stores.

The domestic intelligence service BfV told Handelsblatt the attacks, which also hit stores in three German states, are under active intelligence investigation. Its joint hybrid-threat centre with the foreign and military intelligence services is on it too.

The BfV says the attackers exploited known flaws in the cooling systems' controllers.

[Uros Svete @worldeu]

@alenkamajsep To niso klasicni hladilniki, temvec hladilni sistemi, ki morajo vzdrzevat zaradi obcutljive hrane stalno temperaturo. To nadzorujejo krmilniki (s cipi). Vprasanje je, zakaj so bili ranljivi ali pa z geslom “1234” povezani oz. odprti na internet

[Uros Svete @worldeu]

Nekaj razmišljanj ob zadnjih kibernetskih dogodkih https://t.co/G4cgB9kALg

[Stefan Soesanto @iiyonite]

On November 4, ENISA published a joint statement on the refrigeration cyberattacks across Europe (https://t.co/lnm5ieNzU4).

I was expecting some kind of threat intelligence insights, or a dedicated EU advisory, or perhaps even an example of successful cooperation.

Instead, we got a statement that goes “we monitor" ... "we are aware" ... "we exchange information.” And then reminds companies of their regulatory obligations under NIS2 and the Cyber Resilience Act.

But where was that sense of urgency when it actually mattered?

The warning signs were public in late-August, when US military commissaries experienced suspicious refrigeration failures. A little-known independent non-cyber threat intel investigator pieced together the incidents on her Substack by using open sources and connecting the dots to known vulnerabilities (https://t.co/0N19APZwWA)

By late September, refrigerator failures were being reported at four US military commissaries in Europe (https://t.co/bVCtYWZMno).

Where were the public warnings from ENISA and national cybersecurity authorities then? Where were the proactive advisories to European operators of potentially vulnerable refrigeration systems? Where was the urgency that European authorities demonstrated around PHP2Shell? (I am still waiting for evidence of anything remotely critical as refrigerators being exploited through PHP2Shell)

As far as I am aware, the first targeted public advisories in Europe appeared only after French supermarkets were hit on October 11–12.

This is precisely where proactive threat intelligence and early-warning capabilities should have made a difference. And now, in November, ENISA reminds companies of their obligations? How surreal is that???

Perhaps, instead of pushing out such a statement, ENISA and the national authorities ought to explain how they fulfilled their own threat intel collection and early-warning responsibilities. What did they know, when did they know it, and who did they warn?

You cannot regulate your way out of this potentially massive threat intelligence failure!

[Coffe Report @CoffeReport]

🇩🇰 NEW: SUSPICIOUS AI-GENERATED REQUESTS TARGET DENMARK’S CRITICAL INFRASTRUCTURE

Danish water, wastewater and district heating companies have reported a wave of unusual information requests in recent weeks, raising concerns about possible intelligence gathering.

According to Danish broadcaster DR:

• WATER: Utilities across Denmark have received suspicious requests, including 10–12 smaller waterworks contacted by the same individual.

• HEATING: Several district heating operators received requests from the same email address.

• EDUCATION: At least 50 institutions have received similar requests since October 19.

INFORMATION SOUGHT: Legal proceedings, internal administrative systems and personal information.

Denmark’s Defence Intelligence Service Situation Centre and national security authorities have been informed. Some requests have reportedly been referred to police.

Industry representatives fear the requests could be part of an effort to map critical infrastructure and emergency preparedness.

The identity and motives of those responsible remain unknown. No connection to a foreign state has been established.

[Uros Svete @worldeu]

Skupna izjava evropskih pristojnih organov za kibernetsko varnost in Europola https://t.co/MfE4JlU2c2