> ## Content Index
> Fetch the complete content index at: https://www.metacurity.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Europol pulls the plug on three malware networks
- URL: https://www.metacurity.com/europol-pulls-the-plug-on-three-malware-networks/
- Published: 2026-11-12T14:55:18.000Z
- Updated: 2026-11-12T14:55:18.000Z
- Description: A global operation targeted 235 servers and 257 domains behind Gootloader, CastleRAT and StealC, uncovering more than 6 million stolen victim credentials.
- Author: Cynthia B Brumfield
- Tags: Cybersecurity, News, #no-feature-image

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/11/gootloader-1.png)

Source: Europol.

**Spend less time finding cybersecurity news. Get more out of it.**

Metacurity delivers the cybersecurity news, analysis, and insight that would take you hours—and sometimes days—to assemble yourself.

Every weekday, we sift through thousands of news articles, press releases, filings, court documents, and research reports, including details that vendor announcements and PR pitches leave out. We tell you what changed, why it matters, and what deserves your attention. Minimal vendor marketing. No outrage bait. No SEO filler.

**A paid subscription gives you:**

- **The full Metacurity archive:** Every newsletter, searchable and browsable.
- **Our weekly long-reads roundup:** The best cybersecurity writing from across the industry, selected and vetted to make your reading time count.
- **Specialized reports and analysis:** Periodic deep dives that go beyond the daily headlines.
- **A direct role in sustaining independent journalism:** Your subscription helps keep our editorial priorities focused on readers and the cybersecurity community.

If Metacurity saves you time, helps you spot an important development, or gives you a clearer understanding of the industry, please consider becoming a paid subscriber. Your support keeps that work going.

**Subscribe today—and thank you for reading and supporting Metacurity.**

[Upgrade my subscription](#/portal/account/plans)

### Europol, alongside global partners, has dismantled the criminal infrastructure behind Gootloader, CastleRAT, and StealC malware. In coordinated actions, law enforcement seized 235 servers and 257 domains, severely damaging these malware distribution networks.

The operation targeted "cybercrime-as-a-service" models, where these tools enabled further crimes like ransomware attacks and data theft. During the action, 235 servers and 257 domains were actioned by law enforcement together with private parties.

The participating law enforcement and private partners took action against three malicious toolkits, including Gootloader malware, a so-called dropper/loader, which enabled unauthorized access to computer systems by distributing fake legal documents through compromised websites.

The other two malware kits include CastleRAT**,** a remote access trojan (RAT) known since 2025, and StealC, a so-called stealer with dropper functionality, that was spread through multiple attack vectors.

During the operation, over 6 million victim credentials were identified in the criminal infrastructure owned by the cybercriminals and seized by the authorities this week. The suspects were using these credentials, stolen from the victims after they infected them, to sell them and later use them for other cyberattacks such as ransomware.

Victim data will be made available via platforms HaveIBeenPwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation, and NL-NCSC, alerting victims of stolen credentials caused by the CastleRAT malware. WordPress users are urged to update credentials, enable multi-factor authentication, and patch vulnerabilities. ([Europol](https://www.europol.europa.eu/media-press/newsroom/news/64-million-victim-datasets-secured-in-international-operation-against-malware-networks?ref=metacurity.com))

### United Airlines said that it will prevent personal artificial-intelligence assistants from accessing its systems to book tickets, citing concerns that the third-party agents could expose customers’ sensitive information or make unintended purchases. 

It also said automated AI actions could violate Federal Aviation Administration and Transportation Department rules governing the information airlines must present to customers. An AI agent can’t, for example, attest during check-in that bags don’t contain explosives.

Banks, retailers and a range of other companies are grappling with how best to handle the rise of agents such as Meta’s Muse and OpenAI’s Dots that promise to take care of many of life’s nuisances, from online shopping to scheduling appointments. Early adopters of the technology often use it to comparison shop and search for the lowest prices.

Agents will still have ways to show customers United’s flight options and prices, but they won’t be able to transact on its website. ([Alison Sider / Wall Street Journal](https://www.wsj.com/tech/ai/united-airlines-is-banning-ai-bots-from-booking-flights-5b514b38?mod=djemalertNEWS&ref=metacurity.com))

**Related:** [*The New York Times*](https://www.nytimes.com/2026/11/11/business/united-airlines-ai-agents-booking-flights.html?ref=metacurity.com)*,* [*CNBC*](https://www.cnbc.com/2026/11/11/united-airlines-ai-agents.html?ref=metacurity.com)*,* [*PYMNTS*](https://www.pymnts.com/news/artificial-intelligence/2026/united-airlines-blocks-ai-bots-from-booking-flights/?ref=metacurity.com)*,* [*Reuters*](https://www.reuters.com/legal/litigation/united-airlines-moves-block-ai-agents-its-platform-over-security-concerns-2026-11-11/?ref=metacurity.com)*,* [*Skift*](https://skift.com/2026/11/11/united-airlines-moves-to-block-personal-ai-agents-from-booking-flights/?ref=metacurity.com)*,* [*Forbes*](https://www.forbes.com/sites/suzannerowankelleher/2026/11/11/united-airlines-blocks-ai-agents-booking-flights/?ref=metacurity.com)*,* [*Quartz*](https://qz.com/united-airlines-blocking-personal-ai-agents-booking-flights-111126?ref=metacurity.com)*,* [*Tech Times*](https://www.techtimes.com/articles/330518/20261112/united-airlines-block-ai-agents-booking-flights-its-website-third-parties-this-security.htm?ref=metacurity.com)*,* [*PC Mag*](https://www.pcmag.com/news/united-airlines-is-blocking-ai-agents-for-flight-bookings-over-security?ref=metacurity.com)*,* [*The Information*](https://www.theinformation.com/briefings/united-airlines-blocks-ai-agents-like-muse-instinct-booking-flights?ref=metacurity.com)*,* [*Scripps News*](https://www.scrippsnews.com/us-news/united-airlines-blocks-ai-assistants-from-booking-flights?ref=metacurity.com)

### Poland temporarily shut down a government platform used by citizens and businesses to access public services after detecting and stopping a cyberattack, officials said.

The attack targeted ePUAP, a nationwide system that allows users to submit official documents, communicate with government agencies, and complete administrative procedures online.

Polish Digital Affairs Minister Krzysztof Gawkowski said security teams responded immediately to the incident and were working to restore the platform's full functionality.

"The cyberattack on the state ePUAP system was detected and stopped," Gawkowski said in a social media post.

The minister said the infrastructure of Poland's Central Information Technology Center, the government agency responsible for maintaining key digital services, including ePUAP, remained secure.

Officials said the ePUAP platform was taken offline as a precaution rather than because of damage caused by the attack.

"It's not that the system was somehow compromised or its operation was disrupted by this attack," Marek Gieorgica, a spokesperson for the Digital Affairs Ministry, told Polish news agency PAP. "We simply disabled it as a precautionary measure." ([Daryna Antoniuk / The Record](https://therecord.media/poland-shuts-down-government-services-platform-cyberattack?ref=metacurity.com))

**Related:** [*Reform News*](https://reform.news/en/they-wanted-to-paralyze-government-operations-in-december-poland-says-it-has-prevented-cyberattack/?ref=metacurity.com)*,* [*Security Affairs*](https://securityaffairs.com/202895/security/poland-takes-its-national-e-government-platform-offline-after-a-cyberattack.html?ref=metacurity.com)*,* [*Hromdaske*](https://hromadske.ua/en/amp/it/274180-poland-stops-cyberattack-on-government-services-platform-works-to-restore-full-access?ref=metacurity.com)*,* [*Heise Online*](https://www.heise.de/en/news/Poland-s-ePUAP-portal-offline-after-cyberattack-11521850.html?ref=metacurity.com)*,* [*Warsaw Business Journal*](https://wbj.pl/cyberattack-disrupts-polish-public-administration-platform/post/1033957?ref=metacurity.com)

### A hacking group linked to Russia's FSB security service staged a cyberattack on a Romanian government organisation ​last year, the country's intelligence agency said.

Romania, a European Union and NATO member, shares a land border of more than ​600 km (370 miles) with Ukraine, and centrist President Nicusor ​Dan has said it is the target of a ⁠hybrid war waged by Russia to destabilize nations that ​support Kyiv.

The attacks have ranged from drone incursions into Romanian airspace to ​cyberattacks, disinformation campaigns, acts of sabotage and attacks on cargo vessels near Romanian waters, Dan has said. Russia has repeatedly denied accusations that it is ​waging a hybrid war against European states.  
Russian-linked APT hacking group Turla ​was behind the December 2025 cyberattack, Romania's intelligence agency SRI said, adding ‌that it had "implemented measures to counter the attack and remedy its effects".  
"The attackers exploited a series of systemic vulnerabilities in Microsoft operating systems, but the attack was stopped after the National ​Cyberint Centre intervened," ​SRI said in ⁠a statement.

Cybersecurity firm ESET said on Tuesday that Turla had targeted the unnamed Romanian state institution by using previously undocumented malware ⁠designed ​to identify emails sent or received ​from NATO and the EU. ([Luiza Ilie / Reuters](https://www.reuters.com/technology/romanian-intelligence-agency-says-it-identified-russian-linked-cyber-attack-2026-11-11/?ref=metacurity.com))

**Related:** [*The Romania Journal*](https://www.romaniajournal.ro/amp/society-people/law-crime/romania-foils-russian-turla-cyberattack-on-government-agency/?ref=metacurity.com)*,* [*National Technology News*](https://nationaltechnology.co.uk/Romania%5FIdentifies%5FRussian%5FLinked%5FCyberattack%5FOn%5FGovernment%5FInstitution.php?ref=metacurity.com)

### The Russian cybercrime group Qilin has emerged as the world’s most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone, and the administrator of Qilin has made a few key missteps over the last decade that all point to a 36-year-old man living in St. Petersburg, Russia.

The cyber intelligence platform Intel 471 records that in June 2022, Haise applied for membership to RAMP, a closely guarded Russian cybercrime forum that was created as a haven for ransomware affiliate programs. Intel 471 has indexed direct messages from RAMP (the FBI seized the forum in January 2026), and those missives show the RAMP administrator approved Haise’s application, referring to this user as Haise and by their Telegram username: Alexbigboss44.

Searching Intel 471 for Alexbigboss44 reveals this was the Telegram account name shared by the user Rjun on the Russian cybercrime forums Exploit and XSS two years earlier, in 2020\. The cyber intelligence platform Flashpoint finds Alexbigboss44 is a prolific participant in cybercriminal forums and Telegram channels, primarily focused on the illicit trade of traffic, logs, and corporate access. ([Brian Krebs / Krebs on Security](https://krebsonsecurity.com/2026/11/who-runs-the-ransomware-group-qilin/?ref=metacurity.com))

### Schools across Italy were evacuated on ‌Wednesday after around 6,300 of them received bomb warnings, the latest in a series of threats and cyberattacks around Europe against supermarkets, blood banks, air traffic and broadcasters.

Scotland, Northern Ireland and the Republic of Ireland said many of their schools received a similar email threat from abroad, but it was classed as ​a hoax and did not disrupt classes.

In Italy, schools closed swiftly after the warnings, prompting many parents to drop what they ​were doing to collect children.

A copy of the message seen by Reuters also included a threat to target Prime Minister Giorgia Meloni. She said the bomb alerts posed no danger and that police and other public bodies were monitoring the situation.

The email received in Italy was signed "Mikhail Andropov, ​leader of the Vilayat of Misoginistan," according to a copy of the message seen by Reuters.

The same purported author claimed responsibility for email bomb threats sent on Friday to newsrooms in Ireland and Bulgaria. ([Alvise Armellini, Giselda Vagnoni and Giuseppe ​Fonte in Rome, Sarah Young and Michael Holden in London, writing by Keith Weir / Reuters](https://www.reuters.com/world/least-300-italian-schools-evacuated-after-email-bomb-alerts-2026-11-11/?ref=metacurity.com))

**Related:** [*New York Times*](https://www.nytimes.com/2026/11/05/world/europe/bomb-threats-europe-schools-flights.html?ref=metacurity.com)*,* [*InfoStealers*](https://www.infostealers.com/article/school-bomb-threats-hudson-rock-finds-reported-sender-accounts-in-infostealer-data/?ref=metacurity.com)*,* [*The Media Line*](https://themedialine.org/top-stories/who-is-behind-europes-bomb-threats-and-cyberattacks/?ref=metacurity.com)*,* [*Associated Press*](https://abcnews.com/International/wireStory/300-italian-schools-evacuated-due-bomb-threats-138040834?ref=metacurity.com)*,* [*CNN*](https://www.cnn.com/2026/11/11/europe/italy-europe-bomb-threat-intl?ref=metacurity.com)*,* [*EU Today*](https://eutoday.net/europe-school-bomb-threats-italy-britain-ireland/?ref=metacurity.com)

### According to VulnCheck researcher Patrick Garrity, Anthropic’s Project Glasswing is generating vulnerability reports far faster than documented fixes while shifting validation work onto open-source maintainers.

Anthropic’s disclosure ledger listed 37,966 findings as of November 2, with 7,349 made public and 217 marked fixed, according to Garrity. Since September, findings increased by nearly 12,000, while the number marked fixed rose by just 15.

Garrity also questioned Anthropic’s reported 94.2% true-positive rate. Of 34 reports published by the curl project following an Anthropic scan, maintainers rejected 19 as non-vulnerabilities, confirmed six as low-severity flaws and had yet to assess nine.

VulnCheck separately tracked 442 CVEs attributable to Anthropic, including two known to have been exploited in the wild. Garrity said AI remained useful for vulnerability discovery but argued that Glasswing’s documented results fell short of its launch claims. ([Patrick Garrity / VulnCheck](https://www.vulncheck.com/blog/anthropic-glasswing-november-update?ref=metacurity.com))

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/11/image-22.png)

### York University in Toronto has confirmed that a threat actor breached its systems and accessed personal information submitted through online forms.

The unauthorized access was discovered on October 25 and affected forms submitted on 14 university websites between 2007 and 2026.

York University is a major university based in Toronto, Canada, with more than 55,700 students across 200 undergraduate and graduate degree programs, and an administrative staff of 7,000.

“York was recently subject to a cybersecurity incident involving an unauthorized actor accessing limited online forms used by University departments,” the university stated on Friday.

“While York acted quickly to contain the incident following discovery, we regret to confirm the theft of personal information from some departmental forms.” ([Bill Toulas / Bleeping Computer](https://www.bleepingcomputer.com/news/security/york-university-breach-exposed-personal-information-dating-to-2007/?ref=metacurity.com))

**Related:** [*York University*](https://www.yorku.ca/uit/infosec/incident-faq/?ref=metacurity.com)*,* [*Databreaches.net*](https://databreaches.net/2026/11/11/ca-york-university-breach-exposes-19-years-of-student-health-and-financial-data/?mid=1&ref=metacurity.com#cid=3801779)*,* [*Homeland411*](https://homeland411.com/york-university-breach-19-years-health-financial-data-stolen/?ref=metacurity.com)*,* [*Campus Security Today*](https://campussecuritytoday.com/articles/2026/11/09/york-university-investigates-form-breach-and-data-theft.aspx?ref=metacurity.com)*,* [*SC Media*](https://www.scworld.com/brief/york-university-discloses-data-breach-affecting-departmental-forms?ref=metacurity.com)*,* [*CyberInsider*](https://cyberinsider.com/york-university-data-breach/?ref=metacurity.com)*,* [*CBC*](https://www.cbc.ca/news/canada/toronto/york-university-department-forms-cybersecurity-incident-9.7414235?ref=metacurity.com)

### More than 72,000 passport photographs and 26,000 scanned authorization letters were leaked after several websites operated by the Ministry of Foreign Affairs' Bureau of Consular Affairs (BOCA) were hacked, the bureau said.

The stolen data would not affect the validity of passports and authorization letters already issued, BOCA said, adding that people do not need to immediately apply for new passports.

The bureau apologized for the incident, saying that the affected Web sites had been fixed.

It detected suspected hacking attempts on some of its Web sites on Wednesday last week, the bureau said.

The compromised data falls into three groups, it said.

The first consists of 72,702 passport photo files uploaded between Sept. 3 and Monday last week through individual online appointments, group applications submitted by travel agencies and conditional online passport renewal applications, the bureau said.

The files did not include applications submitted through the one-stop service at household registration offices or in person at BOCA counters, it said.

Other application information, including applicants' names, dates of birth, national identification numbers and passport numbers, did not appear to have been obtained, it said.

The second group comprised 26,072 scanned authorization letters verified by the Taipei Economic and Cultural Office in New York between Oct. 26, 2011, and Friday last week, the bureau said.

The files did not include applications submitted in Taiwan, cases handled by other overseas representative offices, or other types of documents, such as those concerning birth, death, marriage and academic qualifications, it added.

The third group involved 774 applications submitted through the online application system for APEC Business Travel Cards between Sept. 1 and Nov. 9 this year, it said.

The information included applicants' photographs, application numbers, gender, application categories, places of birth, job titles and recommending agencies, it said. ([Fion Khan / Taipei Times](https://www.taipeitimes.com/News/taiwan/archives/2026/11/12/2003867628?ref=metacurity.com))

**Related:** [*Taiwan News*](https://www.taiwannews.com.tw/news/6475539?ref=metacurity.com)*,* [*Taipei Times*](https://www.taipeitimes.com/News/taiwan/archives/2026/11/12/2003867628?ref=metacurity.com)

### Blockchain infrastructure provider Chainstack has confirmed that an outside attacker accessed parts of its systems between October 26 and October 31, 2026.

The attacker reached a customer account database and systems that hold node credentials. Chainstack says the intrusion was part of a wider AI-powered attack campaign and that its customer-facing services kept running normally throughout.

Chainstack published its incident report on November 3 and added technical findings, indicators of compromise (IoCs) and an expanded timeline on November 10\. The page was last updated on November 11\. The company also disclosed the incident in a public statement on X on November 3\. It is emailing all customers and asking them to change passwords, rotate node credentials, and regenerate platform API keys. ([Dishita Malvania / Crypto Times](https://www.cryptotimes.io/2026/11/12/chainstack-hit-by-ai-driven-artex-breach-exposing-customer-data-and-password-hashes/?ref=metacurity.com))

**Related:** [*Chainstack*](https://chainstack.com/security-incident-nov-2026/?ref=metacurity.com)*,* [*The Block*](https://www.theblock.co/news/ecosystems/2026-11-12-chainstack-security-breach-438509?ref=metacurity.com)*,* [*The Defiant*](https://thedefiant.io/news/security/chainstack-urges-credential-rotation-after-data-breach?ref=metacurity.com)

### Researchers at Microsoft say multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain access to Linux servers even after patching the vulnerabilities exploited to gain initial access.

Since March, detections of malicious GSocket activity have increased, particularly in attacks targeting web applications and hosting environments.

GSocket allows attackers to reach systems behind firewalls or NAT by intercepting network connections and replacing the program's conventional IP-layer communication with its own transport layer, which routes traffic through the Global Socket Relay Network.

Since both endpoints initiate outbound connections to the relay, which matches them and brokers an end-to-end encrypted session, an attacker can reconnect without needing the compromised server's IP address or hostname.

This makes it more difficult for defenders to disrupt attacks using IP- or domain-based access control lists.

According to Microsoft Defender for Endpoint telemetry, GSocket-related detections increased by 356.2% between March and August.

Microsoft explains that both the compromised server and the attacker connect outbound, so the server needs no inbound listener implants, making the attack stealthier.

Microsoft says most targets of GSocket activity are in the education and research sector, followed by technology and communications, manufacturing, and government entities.

The researchers recommend that system administrators remove GSocket and associated files from potentially impacted servers, and verify that outbound connections to its relay network have stopped.

They also advise restricting outbound traffic to predetermined destinations and auditing cron jobs, systemd services, and shell startup files for rogue additions. ([Bill Toulas / Bleeping Computer](https://www.bleepingcomputer.com/news/security/hackers-plant-gsocket-on-linux-servers-for-persistent-access/?ref=metacurity.com))

**Related:** [*Microsoft*](https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/11/image-23.png)

Communication scheme. Source: Microsoft

### Three members of a criminal ring were sentenced to prison terms on Thursday for collaborating with North Korean hackers to create and distribute illegal gambling websites in South Korea.

The Seoul Central District Court sentenced one member of the criminal ring to four years in prison and a four-year suspension of qualifications after finding him guilty of violating the National Security Act and operating illegal gambling sites.

The two other ring members indicted in the same case were both sentenced to three years in prison, while one of them also received a three-year suspension of qualifications.

The three individuals were brought to trial as accomplices to the ringleader, surnamed Kim, who was convicted of the same offenses in September and sentenced to five years in prison and a five-year suspension of qualifications.

Kim was found guilty of creating 16 illegal gambling sites in collaboration with North Korean hackers between 2022 and 2024 and selling them to domestic gambling site operators. Kim earned about 23.5 billion won (US$17.6 million) from the sales and transferred more than 7 billion won, or roughly 30 percent of the proceeds, to North Korean hackers.

The three accomplices were accused of helping Kim distribute the illegal gambling sites. ([Yoo Cheong-mo / Yonhap News Agency](https://en.yna.co.kr/view/AEN20261112006400315?ref=metacurity.com))

**Related:** [*Korea JoongAng Daily*](https://www.koreajoongangdaily.com/korea/three-jailed-for-helping-north-korean-hackers-profit-from-illegal-gambling-sites-in-south-korea/12969732?ref=metacurity.com)

### The South Korean National AI Strategy Committee said that it had launched the National Cyber Resilience Enhancement Task Force.

The task force will comprise 11 civilian members, including Lee Won-tae, chair of the committee's Security Special Committee and a specially appointed professor at Kookmin University, who will lead the team, as well as members of the Security and Regional Special Committees, the Defense and Security Division, the Public AI Transformation (AX) Division, and the Global Cooperation Division. Relevant government agencies, including the Ministry of Science and ICT, the Ministry of the Interior and Safety, the Ministry of Climate, Energy and Environment, and the National Intelligence Service, will also participate in efforts to promote cooperation across the government.

The task force will analyze AI threats and policy gaps in existing response systems, and identify policy directions and priority tasks to ensure the continuity, substitution, and recovery of the nation's core functions and essential services. It also plans to consider a field support system that takes into account sites with limited response capabilities, such as small and medium-sized enterprises and local community facilities. ([The Financial News)](https://en.fnnews.com/news/202611121013381057?ref=metacurity.com)

**Related:** [*Digital Today*](https://www.digitaltoday.co.kr/en/view/124836/national-ai-strategy-committee-launches-cyber-resilience-task-force?ref=metacurity.com)*,* [*Seoul Economic Daily*](https://en.sedaily.com/business/2026/11/12/korea-launches-task-force-on-cyber-resilience-against-ai?ref=metacurity.com)*,* [*Chosun Biz*](https://biz.chosun.com/en/en-it/2026/11/12/RNX6WUCS7REITJT27TAWCQNKBI/?ref=metacurity.com)*,* [*Korea JoongAng Daily*](https://www.koreajoongangdaily.com/business/korea-launches-task-force-against-aipowered-cyberattacks/12969418?ref=metacurity.com)

### The UK’s leading cybersecurity agency has officially launched a new scheme designed to help providers of critical infrastructure to test and improve their cyber resilience.

The National Cyber Security Centre (NCSC) first trailed its Cyber Adversary Simulation (CyAS) scheme at the CYBERUK 2025 conference.

It enables participating organizations to choose from a list of vetted suppliers, who then craft realistic attack plans based on reconnaissance of the client’s IT infrastructure, exposure, and threat landscape.

“Testers adopt an adversarial mindset and use appropriate tools and techniques to achieve agreed objectives, rather than being driven by commercially procured threat intelligence or constrained by documented tactics, techniques and procedures (TTPs),” the NCSC said. ([Phil Muncaster / Infosecurity Magazine](https://www.infosecurity-magazine.com/news/ncsc-cyber-adversary-testing-boost/?ref=metacurity.com))

**Related:** [*NCSC*](https://www.ncsc.gov.uk/news/ncsc-scheme-help-critical-organisations-test-their-cyber-defences?ref=metacurity.com)*,* [*Homeland411*](https://homeland411.com/ncsc-launches-cyas-scheme-critical-infrastructure-cyber-defenses/?ref=metacurity.com)*,* [*Advance*](https://www.adsadvance.co.uk/ncsc-new-adversary-simulation-scheme-uk-cyber-resilience/?ref=metacurity.com)

### Best Thing of the Day: Glad He Caught It Before Members of the Com Did

Neycho Tepavicharov, co-founder of Flashcloud, informed a London hotel where he was staying that [he could see on a whiteboard](https://www.theregister.com/security/2026/11/12/london-hotel-put-admin-login-for-booking-website-on-whiteboard-behind-the-front-desk/5308889?ref=metacurity.com) behind the front desk the hotel’s Booking.com administrative username and password. 

### Worst Thing of the Day: Who Can I Turn To, With Apple on a New Day

Apple [is closing](https://arstechnica.com/gadgets/2026/11/apple-is-shuttering-its-28-year-old-online-community-forum/?mid=1&ref=metacurity.com#cid=3801774) its Apple Support Community, which for 28 years has provided Apple users with a way to get quick technical advice about their products.

### Closing Thought

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/11/image-24.png)