Tech & Security News
What happened, why it matters, and what to do.
The vulnerabilities, scams and tech stories worth your attention — including news from across Atlantic Canada — boiled down to a 30-second read.
Nursing Home Without Walls expands to 31 New Brunswick sites
New Brunswick’s Nursing Home Without Walls program has grown to 31 locations and passed 4,000 registered participants. The group is also talking with five provinces about expansion.
Read the briefNvidia CEO Jensen Huang resigns after affair scandal
Jensen Huang has stepped down as Nvidia CEO and left the board. Finance chief Colette Kress is interim CEO while the company looks for a permanent successor.
N.L. government and St. John's city email down in Microsoft 365 outage
Microsoft 365 problems cut email for the Newfoundland and Labrador government and the City of St. John’s. Both say technical teams are working to restore service.
AMD security advisory urges users to install updates
The Canadian Centre for Cyber Security says AMD products are affected by vulnerabilities. Users and administrators should review the advisory and install updates when available.
Nova Scotia considers more rules for AI data centre plans
Nova Scotia’s environment minister says officials are reviewing whether more regulations are needed for future data centre phases. The debate centres on Everwind Fuels’ Point Tupper project and concerns about environment and data sovereignty.
Microsoft 365 outage disrupts Outlook users worldwide
Microsoft says a Microsoft 365 infrastructure issue is affecting Outlook and other cloud services worldwide. More than 100,000 users reported problems, including mail access through web and apps.
Citrix patches NetScaler and Secure Access Client flaws
Citrix has released patches for multiple security flaws in NetScaler ADC, NetScaler Gateway, NetScaler Console and Secure Access Client. The company says it is not aware of any exploits.
Windows CLFS zero-day may let local users gain SYSTEM access
Public exploit code claims a Windows CLFS flaw can let a local user reach SYSTEM access. Microsoft has not confirmed the bug, assigned a CVE, or released a fix.
Alberta expands AI tool that speeds MRI scans after pilot
Alberta is expanding use of an AI technology that speeds up MRI scans after a successful pilot. The move suggests the tool is moving beyond testing into wider use.
Tech sell-off and data centre lending worries draw investor attention
A tech stock pullback has some investors rethinking AI data centre lending risk and bond demand. The article argues bonds may again act as a safe haven if stocks fall.
Cyber Centre flags Progress Software and Microsoft November 2026 advisories
Canada’s Cyber Centre says Progress Software and Microsoft need updates from the November 2026 rollup. Users and administrators should review the links and apply patches as they are released.
Critical Red Hat Quay flaws can expose private container images
Red Hat Quay has two critical flaws that can let attackers read, overwrite, or steal private container images. Red Hat says fixed builds are available for eight Quay 3 branches for one issue.
FTL outlines $2.7 billion Miramichi data centre plan
Fredericton-based FTL says its proposed Miramichi data centre could bring 600 permanent jobs and 2,000 construction jobs. The company says the project would also help stabilise electricity rates.
New Windows SignDrop flaw can give attackers SYSTEM access
A researcher says a Windows zero-day called SignDrop can be used to gain SYSTEM privileges. He says Microsoft's CLFS mitigation introduced the flaw and a patch is still needed.
WatchGuard advisory warns of a product vulnerability
The Canadian Centre for Cyber Security has issued a WatchGuard advisory for a vulnerability affecting one product. No further details were provided in the text.
Apify rotates secrets after unauthorized access to internal systems
Apify says an unauthorised third party got into parts of its internal systems on November 9 and 10. The company rotated API tokens, invalidated credentials and reset active sessions.
Police seize hundreds of servers in Gootloader, CastleRAT and StealC takedown
Europol and partners from nine countries seized 257 domains and 235 servers tied to three malware operations. They also identified 6.4 million victim datasets and over 6 million credentials.
Qvyon launches from Montréal with US$8 million to test physical AI
Montréal startup Qvyon Technologies launched with US$8 million in seed financing. It aims to help autonomous vehicle and robotics companies test dangerous edge cases before deployment.
Ottawa’s BluWave-ai raises $8.1 million for grid software
Ottawa startup BluWave-ai raised $8.1 million in equity, federal funding, and debt. The company says demand is rising as data centres strain electricity grids.
Chrome and Firefox patch more than 180 security flaws
Google and Mozilla released major browser updates that fix more than 180 vulnerabilities. The updates cover critical Chrome bugs and 99 Firefox flaws, but neither company says the bugs are being exploited in the wild.
What a large data centre could mean for Saskatoon
CTV News asks what a large-scale data centre would mean for Saskatoon. The headline suggests a local look at a possible major development.
Canada's AI spending is rising, but GDP gains are lagging
New RBC analysis says Canada’s slower AI adoption has had a net-neutral effect on GDP so far. Economists say bigger productivity gains may still come later.
Saskatoon studies data centres as Bell builds huge Regina site
Saskatoon council voted to study data centres and restrict new ones for now. The debate comes as Bell Canada builds a $1.7-billion, 300-megawatt AI data centre near Regina.
Microsoft says Windows updates are breaking SQL Server performance
Microsoft says recent Windows updates can leave SQL Server connections open and slow systems down. It will release an out-of-band fix in the next few days.
Google Cloud warns AMD Turin VM users to patch for side-channel flaws
Google Cloud says some AMD Turin VM users need a guest OS patch and a stop-and-start to reduce side-channel risk. The company says it has already mitigated attacks between VMs and hosts.
N-able probes N-central exploits after new zero-days are posted
N-able is investigating new N-central vulnerability claims while attackers are already probing exposed servers. Customers running on-premise N-central are being told to disable Legacy API and patch quickly.
Google session hijacking campaign uses Calendar invites and live proxies
A phishing campaign has stolen live Google sessions from corporate users since mid-August 2026. The attackers used Calendar invites and live reverse proxies to capture logins and second factors.
PTC patches Windchill and FlexPLM flaw tied to remote code execution
PTC released a patch for CVE-2026-126325, a critical flaw in Windchill and FlexPLM. Hosted customers do not need to act, but on-premises users should patch as soon as possible.
Nvidia CEO Jensen Huang resigns after affair reports
Nvidia says Jensen Huang has resigned as president and CEO. Colette Kress will serve as interim CEO while the company looks for a permanent replacement.
Microsoft says some Windows 11 PCs can’t install November updates
Microsoft confirmed that November 2026 security updates may fail to install on some Windows 11 devices that already have the October preview update. Affected PCs should repair themselves within 24 to 48 hours.
Halifax gets a share of a $100M AI fund for housing approvals
Halifax mayor Andy Fillmore says federal AI funding could speed up housing approvals. The $100 million fund will be shared by Canadian municipalities over three years.
MongoDB fixes pre-auth crash bug in replica sets
MongoDB fixed a critical flaw that lets an unauthenticated attacker crash a replica set member under the right failover conditions. Standalone mongod servers are not affected.
Node.js fixes HTTP/2 and HTTPS flaws that can crash or leak data
Node.js fixed 16 flaws, including HTTP/2 and HTTPS bugs that can crash servers or leak memory from other connections. The project released fixes for all supported lines.
Apache HTTP Server HTTP/2 bug can let attackers run code remotely
Apache fixed a critical HTTP/2 flaw in version 2.4.71. Servers with HTTP/2 enabled should update or turn off h2 and h2c until they can.
Baker Tilly says third-party breach exposed client personal data
Baker Tilly is notifying clients after a breach at a third-party service provider exposed personal information. The company says it found the issue on September 6 and finished reviewing the data on October 28.
ScreenConnect attacks hit MSPs and dozens of customer organizations
ConnectWise is investigating active attacks using compromised ScreenConnect environments to deploy rogue remote-access clients. Huntress says it has found six compromised MSPs and 286 affected endpoints across 47 organizations.
AI progress may accelerate, says OpenAI Foundation board member
Paul Christiano says AI development is unlikely to slow soon and could accelerate further. He warned of serious near-term risks during a talk in Toronto.
Cambridge data centre spill not linked to later pond bloom
A Cambridge data centre owner says a 5,000-litre glycol spill was not the cause of a later milky pond substance. A local MPP is calling for the testing results to be released.
Maersk says breach hit acquired legacy system, not core operations
Maersk says a threat actor accessed a local legacy system tied to an earlier acquisition and extracted data. The company says operations should continue normally and no sensitive data has been disclosed.
Zoom patches critical Workplace for Windows privilege escalation bugs
Zoom fixed two security flaws in Zoom Workplace for Windows, including a critical privilege escalation bug. The company says users should update to the latest version.
AntiFox linked to AWS credential theft and webshell attacks
Researchers say attackers used Alibaba Cloud-hosted AntiFox instances to target web services and AWS environments. They obtained production secrets in some cases.
Google DeepMind’s AlphaGenome 2 aims to map DNA changes to disease
Google DeepMind unveiled AlphaGenome 2, a model that predicts how DNA changes affect different cell types and states. Google says it could help researchers spot disease-relevant effects earlier.
Citrix and Ivanti patch 19 vulnerabilities
Citrix and Ivanti fixed 19 flaws, including critical bugs that could enable remote code execution and certificate tampering. Both companies say they have no evidence of exploitation in the wild.
Microsoft says November update fixes USB audio problems in Windows
Microsoft says its November 2026 security update fixes USB audio issues that affected Windows users since September. The company says the update also resolves Outlook sign-in and mail delivery issues on Exchange Server systems.
Siemens and Schneider Electric publish new ICS security advisories
Siemens and Schneider Electric released new industrial security advisories, including issues tied to Node2Shell. Some Siemens fixes are not yet available, so mitigations are needed.
CISA flags Cisco BroadWorks flaw as actively exploited
CISA says attackers are exploiting a Cisco BroadWorks flaw that can expose sensitive configuration data. Federal agencies have until November 24 to patch it.
Microsoft fixes Exchange sign-in and mail flow issues
Microsoft says its November updates fix Outlook sign-in and email delivery problems caused by October Windows Server security updates. A temporary workaround is also available.
Everwind says $8-billion Nova Scotia data centre will use no public money
Everwind Fuels says its Nova Scotia data centre campus will be fully privately funded and will not take provincial support. The company says financing has closed on the first facility.
Xplore wins court protection as rural internet service continues
Xplore has obtained creditor protection under the CCAA, but says service, rates and support will stay the same. The rural internet provider says its networks will keep running while it restructures.
OpenAI buys Odessia, Francis Davidson’s AI travel startup
OpenAI has acquired Odessia, the AI travel agent startup founded by Sonder co-founder Francis Davidson. Odessia’s service is no longer available, and the purchase price was not disclosed.
Railway says hackers stole secrets and drove $740,000 in AI charges
Railway says attackers stole customer secrets, internal code and credentials, then generated about $740,000 in fraudulent AI usage. Up to 100,000 workspaces may have been affected.
Loblaw faces proposed class action over breach affecting 2 million Canadians
A proposed Ontario class action says Loblaw failed to protect personal data for about two million Canadians and delayed direct notice. Loblaw says it will contest certification.
Grok Build leaks confidential files from thousands of apps
Claroc says Grok Build links exposed data from 35,000 apps, including sensitive business information. Some of the leaked material came from 24 SpaceXSI apps.
Nitori says hackers may have stolen 37.62 million customer records
Japanese retailer Nitori says an attacker may have accessed and leaked up to 37.62 million customer records. The company blocked access after detecting the intrusion on November 6.
Microsoft patches 1,235 flaws, including exploited Outlook zero-day
Microsoft’s November Patch Tuesday fixes 1,235 flaws, including an actively exploited Outlook spoofing bug. Users should update affected Microsoft products now.
Microsoft ships November Windows 11 security and feature updates
Microsoft released mandatory Windows 11 cumulative updates for 26H2, 25H2, 24H2 and 23H2. They fix security vulnerabilities and bugs, and add new customisation options.
Canada signs AI safety declaration with countries and developers
Canada has joined the Paris Call for AI Safety and Security with five other countries and 10 AI companies. The pledge calls for model testing, early warnings and shared standards.
Air Canada, data centres and AI protests dominate Atlantic headlines
Atlantic headlines point to airline service changes and growing backlash over AI data centre plans in Nova Scotia and New Brunswick. Several outlets report protests, NDP messaging and new findings on a New Brunswick data centre.
Google opens Gemini 4 Carbon while using AI to verify Signal code
Google expanded access to Gemini 4 Carbon for paying developers and businesses. DeepMind also used AI agents to help prove security guarantees in Signal’s code.
Xen Orchestra flaw is being exploited to hijack VM management servers
A critical Xen Orchestra authentication bypass is being actively exploited. Vates says attackers can gain admin access and take over XCP-ng hosts.
Attackers exploit patched AhsayCBS flaws to plant stealthy Python backdoor
Huntress saw attackers use two patched AhsayCBS flaws to break in and drop a Python backdoor. The intrusion also installed miners, web shells, and remote access tools on backup servers.
Ontario securities watchdog warns about quantum-powered data theft
The Ontario Securities Commission says firms should prepare for criminals stealing encrypted data now and decrypting it later with quantum computers. It is urging inventories of cryptographic assets.
Binance warns of iPhone file access flaw affecting iOS 26 and 27
Binance says a published iOS sandbox escape could let apps read other apps’ files, including wallet keys and login details. Apple’s latest updates do not list a fix.
Fireworks AI says breach exposed billing data and incomplete models
Fireworks AI says attackers reached its development machines through a third-party cloud provider and accessed billing data, secrets, datasets and incomplete model weights. The company says no payment card numbers were stored or exposed.
New Brunswick proposes building code changes for data centres
New Brunswick is proposing changes to building codes to limit the size and power use of data centres. The headline gives no further details.
EverWind’s conflicting backup power numbers draw scrutiny
EverWind’s backup power supply figures are being questioned. The Halifax Examiner says the numbers conflict, but the headline gives no further details.
Anthropic targets IPO with valuation up to $1.4 trillion
Anthropic says its public offering could value the company as high as $1.4 trillion. It plans to sell 825 million shares at $70 to $78 each.
Canada backs AI safety pledge with OpenAI, Anthropic and Cohere
Canada joined a Paris Call pledge with AI developers and governments to support testing, transparency, and safety standards. The declaration focuses on dangerous misuse and the risk of losing human control over AI.
SAP patches four unauthenticated 10/10 flaws in NetWeaver and Gateway
SAP fixed four maximum-severity flaws in NetWeaver, Web Dispatcher and Gateway. The bugs can let attackers run code or take control without logging in.
CIRO proposes $8.3 million settlement after 750,000-person data breach
CIRO has proposed an $8.3 million settlement over a 2025 breach affecting about 750,000 Canadians. The deal would add credit monitoring and reimburse documented losses up to $10,000.
Toronto AI firm Blue J raises US$176 million to expand tax tools
Blue J Legal raised US$176 million to grow its AI products for tax professionals. The Toronto company says it now serves more than 6,500 client firms.
Apple fixes iMessage group chat privacy flaws and Bluetooth bugs
Apple released updates for iMessage flaws that could expose group messages and Bluetooth pairing issues. The company does not say the flaws were exploited.
Barracuda says attackers are exploiting two Email Security Gateway flaws
Barracuda says two ESG vulnerabilities are being used in attacks and can lead to root access. Customers should patch and restrict admin interface access.
Turla uses new Cereal malware to spy on government Exchange servers
Turla is using a new toolset called Cereal to collect emails from Microsoft Exchange servers. ESET saw it in government organisations in Kazakhstan and Romania.
Google patches eighth actively exploited Chrome zero-day this year
Google released an emergency Chrome update for CVE-2026-125350, a use-after-free bug already exploited in the wild. Chrome users should update now.
York University says cyberattack stole personal data
York University says an unauthorized actor stole personal information from online forms. The school is warning affected people to watch for suspicious contact and monitor accounts.
Vanderbilt says ransomware gang claims attack and data theft
Vanderbilt University says it is responding to a cyberattack claimed by the BYOD ransomware gang. The gang says it encrypted databases and stole student, employee, and research data.
Paramount Skydance CEO says AI will reshape film production
David Ellison says AI could be the biggest creative unlock in modern history and will significantly reshape Paramount Skydance. He says the company is building its own AI tools but will not replace artists.
CTV reports new findings on New Brunswick data centre impact
CTV News says there are new findings on the impact of a New Brunswick data centre. The headline gives no further details.
SEGA says newsletter breach exposed 2.2 million email addresses
SEGA says a breach at newsletter provider ARARA exposed 2.2 million subscriber email addresses. The company says it has no confirmed evidence of misuse.
N-able takes hosted N-central offline after 30+ zero-days disclosed
N-able took its hosted N-central environments offline after a researcher disclosed more than 30 alleged zero-day flaws. On-premises customers were told to shut down servers while N-able builds a hotfix.
Ottawa promises 500 MW of sovereign AI compute for Canadian startups
The federal government will use new financial tools to help Canadian AI companies access 500 megawatts of sovereign compute. The goal is to keep smaller startups from being crowded out.
Hackers are exploiting the OpenSSH SSHole flaw on Linux systems
Hackers are actively exploiting the SSHole flaw in OpenSSH to get into some Linux systems. The fix is available, and users should update and check for unusual login activity.
Canada names Karen Karniol-Tambour to lead sovereign wealth fund
Ottawa has chosen Karen Karniol-Tambour to run the $25-billion Canada Strong Fund. The fund is meant to back nation-building projects and more investments like the $1.6-billion Cohere deal.
Apple starts selling $50 usage packs for some AI features
Apple is charging $49.99 for extra usage in Logic Pro’s Apple Intelligence features. The packs extend access to some cloud-based AI tools with usage limits.
Anthropic launches Claude Fable 5.2 and Mythos 5.2
Anthropic says its new Claude Fable 5.2 and Mythos 5.2 models improve coding, reasoning, vision, and speed. Claude Mythos 5.2 is starting with vetted organisations only.
Qubole AWS customer accounts were breached, Wiz says
An attacker used Qubole AWS credentials to access multiple customer accounts between October 14 and 26. Wiz says the attacker stole secrets and data from AWS services.
France blames Iran for last month’s supermarket fridge cyberattack
France says Iran was behind a cyberattack on supermarket fridges last month, according to headlines from multiple outlets. The sources do not add further details.
Binance denies breach claim after ShinyHunters post
Binance says it found no evidence of a breach after a threat actor claimed to sell data on 335 million users. The exchange told customers to watch for phishing and never share keys or codes.
AI is changing bank security and company regulation debates
CIBC says AI is speeding up cyber threats and changing how banks handle security. Separately, Anthropic’s proposed public benefit fund is raising questions about whether companies should shape AI rules themselves.