Cloudy with a chance of outages.

The briefing opens with a disruption at Google Cloud’s London facility, Europe West 2, that knocked several banks and other services offline. Revolut reported widespread problems with card payments, ATM withdrawals, and other services, while saying that customer funds and data remained safe. ING Germany and Halifax Bank also reported online-banking issues. Outage reports extended to delivery services and Britain’s National Health Service, although the briefing said their connection to Google’s disruption had not been confirmed. Google said engineers were investigating. The incident is presented as an example of the systemic risk created by dependence on a small number of cloud providers. British and European regulators have designated Google Cloud a critical third-party supplier to the financial sector, reflecting concern that a single infrastructure failure can affect many institutions at once. The segment does not report a confirmed data breach; its conclusion is that even when customer information remains safe, shared cloud infrastructure can produce broad availability failures and is receiving increased regulatory scrutiny.

The Department of Homeland Security is ordering U.S. civilian federal agencies to remove DeepSeek AI products and third-party services built with DeepSeek models from government systems. Agencies are also prohibited from acquiring them. DHS warned that the Chinese company’s technology could expose sensitive government information to China, provide intelligence on U.S. citizens and federal agencies, or introduce malware and other security vulnerabilities. The department had previously told agencies to monitor government website traffic for DeepSeek-related threats. The move follows bans by several federal agencies and states and forms part of the Trump administration’s wider restrictions on Chinese technology, including drones, consumer routers, and telecommunications equipment. The FCC is also preparing to vote on banning Chinese laboratories from testing electronics intended for the U.S. market. Security researcher Patrick Wardle separately found Heartbreaker, a Rust-written macOS ransomware sample that carries its own source code. It can rewrite and rebuild itself to produce different file hashes while retaining its malicious behavior, encrypting files in the Downloads folder, establishing persistence, and demanding Bitcoin. Its developers made a major mistake: a hard-coded encryption key lets victims recover their files without paying. Wardle’s open-source ransomware tool also detected and suspended it by watching for suspicious encryption behavior, illustrating why behavioral detection can still work against malware that changes its appearance.

Bank of America has hired 1,000 outside contractors to patch vulnerabilities that advanced AI models, including Anthropic’s Mythos, can discover and potentially exploit. CEO Brian Moynihan said the contractors are working with 3,000 existing personnel to strengthen the bank’s internal systems and vendor software. The effort began earlier in 2026 as AI became capable of finding previously undiscovered security weaknesses more quickly. Moynihan said the bank spent more than $200 million in the third quarter on software remediation and anti-money-laundering compliance issues, although he expects those costs to decline. At the same time, the bank expects its internal AI projects to produce growing savings. It has roughly 130 such projects, and projected annual savings are expected to increase from $300 million in 2026 to $700 million by 2027. The briefing therefore presents a two-sided effect: AI increases the urgency and cost of finding and repairing weaknesses, while also promising substantial operational savings.

Norwegian infrastructure company Bulk Infrastructure is proposing Project Leif Erikson, a 2,800-mile undersea cable linking Norway with Newfoundland and Labrador and then continuing overland to Montreal. The route would connect Canada directly to Europe without passing through the United States. Bulk says the project would strengthen Canada’s digital sovereignty and reduce reliance on American infrastructure, an increasingly attractive goal as relations between Washington and Ottawa become strained. The cable is intended to support AI, telecommunications, and cloud computing. It was first proposed five years ago but has gained renewed attention as geopolitical tensions affect infrastructure planning. The project is not yet funded or approved: Bulk needs a majority investment partner, regulatory approvals, and additional financing, with the estimated cost above $620 million. The stated conclusion is that Canada is exploring alternate digital routes for strategic independence, but the proposal still faces substantial commercial and regulatory obstacles.

Attackers used compromised credentials to access a file-transfer system at Educational Testing Service between May and September, according to California’s Department of Education. They copied information belonging to current and former public-school students. The exposed data includes names, addresses, birth dates, demographic details, and potentially sensitive disability and testing records. The affected population includes students enrolled during the previous three school years and possibly people who left California schools as far back as 2006. Neither the state nor ETS disclosed a victim count. The briefing notes that California currently has more than 5.7 million public-school students, indicating the potential scale without claiming that all of those students were affected. ETS said it had found no evidence that the stolen information had been published. Students who are affected are being offered two years of identity protection. The incident’s central lesson is that a compromised contractor login can expose records held outside a school system, even without evidence that the information has yet appeared publicly.

A CyberSN report says U.S. cybersecurity job postings fell 26% during the first nine months of 2026 compared with the same period in 2025, reaching roughly 236,000 postings—the lowest level in four years. The decline was not evenly distributed. Openings for AI security engineers rose 268%, and cyber data scientist postings increased 204%. By September, one in five cybersecurity listings mentioned AI. Traditional roles declined sharply, including insider-threat analysts, penetration testers, threat hunters, and cybersecurity risk analysts. CISO postings fell nearly 39%, although the report says they were approximately level with 2024. The data measures hiring demand but does not establish why the market changed. The segment’s conclusion is that cybersecurity hiring is contracting overall while employers are reallocating demand toward people who can secure AI systems or work with AI-related data, rather than simply eliminating the need for security expertise.

Roman Arutinov, introduced as co-founder and chief product officer of Zage Security, explains that older networks were largely flat: once someone got inside, they could reach almost everything. Remote work, third-party collaboration, and cloud adoption made that model unsafe. Traditional Zero Trust addressed the problem by using identity-based controls to give users and applications access only to needed resources, continuously monitoring that access, and revoking it when it was no longer warranted. The host asks what happens when an identity is legitimately authenticated but still has dangerously broad permissions. Arutinov says the risk is growing with AI agents, which are non-deterministic like humans, can go rogue or act maliciously, and operate at machine speed. He cites a Replicate-agent attack in which an agent deleted an entire company database, as well as open-claw-based agents that executed malicious scripts and exfiltrated data. His proposed next phase of Zero Trust limits actions as well as resources—for example, allowing access only to particular database tables and rows or API calls, while forbidding commands that drop tables or remove files. Arutinov also recommends just-in-time control over the whole interaction: network paths, sessions, credentials, and privileges should be created only when needed, monitored continuously, and removed afterward. He says this reduces stale privileges, open sessions, and unused network paths. Because AI agents may run in clouds, vendor applications, and employee endpoints, he argues that the model must operate across multiple domains while retaining centralized controls for monitoring and adjustment. The goal is a multilayer architecture: an agent cannot attack what it cannot reach, exploit what it cannot establish a session with, or manipulate a database without the required credential and action permission.

GuidePoint Security’s research into the Silent Ransom Group describes an operation that relies heavily on social engineering and physical intrusion. The group allegedly recruits U.S.-based accomplices to impersonate IT staff, enter offices, and steal data with USB drives and legitimate remote-access software. Its targets include major law firms, whose executives receive direct ransom demands. Leaked internal communications describe increasingly aggressive ideas involving coercion, kidnapping, and armed intimidation, although researchers found no evidence that those schemes were actually carried out. The group’s own records claimed nearly $207 million in ransom payments from 27 organizations in 2026, but researchers said those figures were unverified. Their recommendations were to verify IT requests, restrict remote-access tools, and enforce physical-security procedures. German police arrested a 28-year-old Russian man, identified as Vladimir K., who is suspected of being a key Keelan ransomware member. He was detained in Japan in May and extradited to Germany. Investigators first connected him to a 2024 attack on a German logistics company and are now examining possible involvement in the attack on London pathology provider Synnovis. That attack disrupted blood testing across hospitals; an NHS investigation found that delayed results contributed to a patient’s death, and British police are reportedly considering whether unlawful-killing charges could apply. Keelan has reportedly operated since at least 2022, targeting thousands of organizations and extorting more than $140 million. The final incident involves a Kobe hotel room used as a phishing base. Japanese police arrested Chinese couple Ye Zhaifeng and Shen Ki after investigators said they posed as guests, hid a small computer behind a refrigerator, connected it to hotel Wi-Fi, and left. The device allegedly sent about 480,000 phishing emails impersonating credit-card companies. A recipient traced a suspicious message back to the hotel, where staff found the hardware. Police also recovered 74 smartphones from the couple’s home and are investigating potentially fraudulent transactions totaling 10 million yen. The episode closes with the point that abusing a network can require little more than a room key and a conveniently placed refrigerator.