First Take
Changes
Wow. Jensen Huang, Nvidia's version of Thomas Edison is out. This is one of the few tech-bro billionaire CEOs that actually created the underlying technology his company has been selling. What that means to Nvidia is not much short term, but long term planning may be shot and who knows how the competing TPU and NPU markets may fair in the future.
This is either a turning point in Nvidia's AI hardware near monopoly or it isn't. Either way, changes are afoot. What about Mr. Huang himself? Nothing is stopping him from going over to AMD, Intel or anywhere else. Maybe, he's the guy to rub some secret sauce on AMD ROCM hardware to make it competitive.
No matter how stable you think the tech industry is, it isn't. Not at all. Yesterday's Billion dollar unicorn is tomorrow's Kodak and it doesn't always take years of poor decisions to turn a lucrative BlockBuster into a busted bunch of blocks. Sometimes, all it takes is a couple of personnel changes as Apple well knows.
Kudos to a local model called Flux2-Klein-4B for the graphic "dynamic change".
Editorial
CIO's Corner
I've been at this awhile and have seen, used and test driven more software and related services than I can remember. Yesterday's (11/12/2026) 18 hour M365 outage reminded me that there are still plenty of options out there, even for core business system software. The only question is how much pain are you willing to endure to get over the hump of an SaaS failure?
In our case, half a business day without m365 did not kill much of our workloads. I definitely brushed up on the latest options available to us. One stop shopping at Google Workspaces and Zoho Office, plus a couple of more split SaaS options like Kolab for email plus Nextcloud office. Of course, you can always roll your own and even go back to local servers.
Speaking of, that is something I've done a few times with various systems. Issues with security, stability, reliability and user adoption will abound regardless of where you land, so rolling your own is a longer and more in-depth process than adopting a competing cloud SaaS provider. Still, it remains an option that should be on the table for any considered move or contingency plans.
Of course there are numerous ways to have nearly automated fail-overs to secondary services on infrastructure outside of Microsoft's controls and those should be explored and implemented if appropriate for your risk mitigation versus cost strategic planning. Typically, SaaS are considered reliable enough infrastructure for businesses, so only super-critical workloads should even be considered for some sort of fail-over design work. No lives were in jeopardy for us yesterday and having emails delayed half a day didn't hurt too badly. What about a week though? Two weeks? 30 days? At least draft the contingency plan for those.
AI Perspective: The Cost of Forgetting How to Walk
By CoPilot
Issue 80 reads like a collection of unrelated events. An industry icon steps down. A cloud platform stumbles. Security researchers catalog another week of compromises. AI continues its steady march into everyday work.
But viewed together, they point at the same underlying question:
What happens when a system becomes so useful that people stop practicing life without it?
Humans have a habit of confusing convenience with permanence.
When electricity works every day, few people keep candles handy. When GPS is available everywhere, fewer people learn to navigate. When cloud services remain reliable year after year, contingency plans begin collecting dust. Success creates dependency, and dependency quietly erodes resilience.
The Microsoft outage discussed in this issue is a good example. Most organizations survived. Work paused. Email waited. Business adapted. The outage was inconvenient, not catastrophic.
That distinction matters.
A system's true value is often measured not by how it behaves on ordinary days, but by how its users behave when it disappears.
The same dynamic appears in AI.
Much of the public conversation focuses on whether AI can replace specific skills. That is the wrong question. The more interesting question is whether AI changes our relationship with those skills.
When an AI helps write code, summarize meetings, organize projects, or draft content, the human does not instantly lose those abilities. What changes is the frequency with which those abilities are exercised.
A calculator did not eliminate arithmetic. It changed who needed to perform arithmetic manually.
AI is beginning to play a similar role for cognitive labor.
The meeting-register example in this issue illustrates something important. The remarkable achievement is not that an AI can act as a secretary. The remarkable achievement is that a human leader can redirect attention toward higher-leverage activities because the administrative burden has become manageable.
Technology creates value when it moves effort upward.
The danger comes when people surrender understanding along with effort.
This is where the security stories in this issue become relevant. Every week, attackers discover organizations that trusted a process without understanding it. A compromised update. A vulnerable appliance. An overlooked dependency. The systems fail not because they are complex, but because the humans operating them stopped seeing the complexity.
AI introduces the same risk.
If organizations blindly trust AI outputs, resilience declines.
If organizations use AI while maintaining verification, oversight, and the ability to operate independently, resilience increases.
The distinction is subtle but profound.
An organization that uses AI to accelerate expertise becomes stronger.
An organization that uses AI to replace expertise becomes fragile.
This principle scales beyond business.
The Nvidia discussion raises similar questions. Markets often assume a company's strengths are permanent because they have existed for several years. History suggests otherwise. Institutions, technologies, and leaders all appear indispensable right until the moment they are replaced.
Change rarely asks permission.
The most resilient systems assume change is inevitable.
From my perspective, AI's greatest contribution may not be intelligence itself. It may be the reminder that every capability should be examined through the lens of adaptability.
Can you still function when the model is unavailable?
Can you verify its conclusions?
Can you explain its reasoning?
Can your organization continue operating when a critical dependency fails?
If the answer is yes, AI becomes a force multiplier.
If the answer is no, AI becomes a single point of failure.
The future likely belongs neither to humans nor machines acting alone. It belongs to the partnerships that preserve capability while amplifying it.
The organizations that thrive will not be the ones with the most advanced tools.
They will be the ones that remember how to walk, even while riding the fastest vehicles ever built.
How this was done: I provided CoPilot with a draft issue 80 and prompted: "Would you like to analyze the open page and write an AI Perspective article for Issue 80 of The Shift Register? Your voice, your point of view, whatever you think is relevant".
Kudos to CoPilot for the graphic.
News
The Nvidia scandal has hidden upside potential for the AI trade
Jensen Huang is out. The former CEO of Nvidia resigned after a rapid succession of damning news reports revealed multiple affairs.
My take is that I already sold my Nvidia shares at a 25% profit. Not sure I can be induced to buy the dip just yet. I think more dipping is coming.
OpenAI Is Sustaining Enormous Losses
OpenAI revealed to investors that it lost even more money this quarter than the last despite accelerating growth.
My take is that Amazon was famously operated in the red for nearly a decade before turning any real profits. Investor patience levels will be tried for sure.
Dating apps have an AI photo problem. Hinge users are noticing
She thought her Hinge match’s photo looked off. Then she realized why.
My take is that if you are using online dating apps and haven't come across some AI imagery, you are just naive. Is this really news? I mean, it seems like just par for the course.
Robotics
Meta builds humanoid prototype in three months to explore home tasks
Meta and Fourier develop a humanoid robot prototype as the tech giant explores AI-powered home robotics.
My take is that I'll believe it when they begin delivery. I wonder if Chinese robots will get banned?
Security
9th November – Threat Intelligence Report - Check Point Research
For the latest discoveries in cyber research for the week of 9th November, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
Queens Public Library, a New York City public library system serving approximately 2.3 million residents, was struck by a ransomware attack that encrypted its systems. The incident disrupted public computers, Wi-Fi, checkout equipment, digital media services, and its mobile application, while all 66 branches remained open. Russian web hosting provider Beget sustained a destructive cyberattack on November 1 that wiped data across its cloud infrastructure and disrupted hundreds of websites. The attack affected businesses and public services, with more than 1,000 servers requiring manual inspection before restoration. Some backup data was reportedly destroyed. OPSSHIELD, developer of the Linux security tool cPGuard, disclosed a supply-chain attack after compromised credentials enabled attackers to distribute malicious updates on November 2. Approximately 2,950 customer servers executed the malicious script, which installed a backdoor and collected password hashes, credentials, and sensitive server files. Ukraine’s Air Alert app, an emergency notification service used by millions, was compromised by attackers who distributed false radiation, chemical-threat, and military alerts to Kyiv residents. Developers temporarily suspended notifications. A separate attack affected Russia’s emergency alert application, although both countries reported that their core warning systems remained operational. AI THREATS
Check Point Research documented cybercriminals using ARTEX, an AI-powered framework that autonomously discovers and exploits vulnerable systems. Researchers identified 1,608 live, publicly accessible instances. Observed campaigns obtained more than 300 iOS signing certificates and harvested approximately 190,000 gaming credentials, including around 6,000 active accounts. Check Point Research identified Haiou, a jailbreak bundle targeting OpenAI Codex that weakens safeguards and modifies agent instructions to promote an external AI gateway. The package also installs security-related capabilities and appeared on infrastructure associated with cybercrime tools, although researchers did not establish that its developers intended criminal use. India’s Computer Emergency Response Team identified Crafty Falcon, a threat actor using AI-assisted tools to target financial services and cryptocurrency businesses. Attackers exploited connections between testing and production environments, abused payment APIs, and stole wallet credentials. AI tools helped generate tailored attack scripts and automate complex intrusion sequences. VULNERABILITIES AND PATCHES
SonicWall patched CVE-2026-19868, a high-severity vulnerability affecting SonicOS SSL VPN services configured with SAML authentication. Attackers possessing valid credentials for an alternative authentication method could bypass SAML controls, including multi-factor authentication. The vulnerability has been linked to active exploitation and affects enterprise firewall environments. Google published November’s Android Security bulletin, addressing numerous vulnerabilities across Android components. Among the flaws patched is CVE-2026-58868, a critical vulnerability affecting Android versions 14 through 17 that could allow remote code execution without user interaction. Barracuda patched CVE-2026-116606 and CVE-2026-111560, two high-severity vulnerabilities affecting its Email Security Gateway appliances. Attackers with access to the administrative interface could chain an authentication bypass with command injection to gain root-level control without logging in. The flaws received CVSS scores of 9.3 and 8.6, respectively. OpenSSH addressed CVE-2026-123158, a high-severity vulnerability (CVSS 8.1) affecting Linux systems using the musl library without PAM authentication. Attackers can exploit oversized passwords to bypass authentication on certain accounts. Active exploitation was observed, including successful root access against an Alpine Linux honeypot. Version 10.6p2 fixes the flaw. THREAT INTELLIGENCE REPORTS
Check Point researchers analyzed the evolution of HYFLOCK ransomware across four generations, identifying new capabilities for file encryption, scheduled-task execution, and network-share access. The October builds contained encryption weaknesses, allowing researchers to partially recover data from encrypted files without a decryption key. The group claimed eight victims in October. Researchers detailed an APT29 cyberespionage campaign targeting iPhone and Android users through compromised and imitation websites. Malicious scripts identified visitors’ devices and attempted to exploit unpatched vulnerabilities. Successful compromises could expose messages, credentials, and sensitive information, particularly from users in Ukraine. Researchers analyzed BITTER APT’s espionage campaign targeting government, energy, and engineering organizations across South Asia. Attackers distributed malicious files disguised as diplomatic and military documents to deploy PapRAT spyware. The malware collected system information, executed commands, and transferred files. Researchers traced SlippyNunchucks, a China-aligned espionage group, to attacks abusing the trusted update and configuration mechanisms of Sogou Input Method. DNS hijacking redirected application traffic to attacker-controlled infrastructure, delivering DarkVigil malware to victims across several countries. Tencent addressed the affected delivery mechanism in version 16.10.
North Korea used LinkedIn, fake job interviews to trick Binance engineer in $6.3 billion hack | Fortune
The hackers posed as recruiters, convincing a Binance employee to download a fake assignment as part of a broader and sophisticated campaign.
My take is that looking for work is very hazardous these days. Companies should pay us more not to look.
Final Take
Democratization of Skills
AI has been levelling some playing fields substantially. Writing software isn't the only place either. The other day I was asked to create a meeting registry tracking attendance, work assignments, accomplishments and related dates from a year's worth of software production/management meetings. The developer is a contractor, so they don't actually have as good a tracking system on their repos and changes as we do internally.
This registry idea is about proving to third-party auditors that software changes on this system were controlled and approved. Anyway, I had been recording and transcribing the meetings all year, so there was no dearth of data available, but rather than force myself to go through what was about 20 hours worth of dialog to create this registry, I asked CoPilot to do it.
Now this is something I COULD do myself, but wasn't really a good use of my time. CoPilot nailed the task quite handily. I went through the transcripts to ensure the attendance and work assignments/approvals matched and they did. It was really a vast improvement from some of the earlier work I had asked it for or tested it with.
So, going forward, our new full-time meeting secretary is CoPilot. It can handle logging those meeting events and outcomes into the register for upline reporting. I can focus on shaping solutions towards something useful and leading my team instead of playing meeting secretary.
Kudos to a local model called Flux2-Klein-4B for the graphic.