root@ransomvault:~$ tail -f threat_intel.log

Threat Intelligence

Microsoft 365 Outage Shows Early Signs of Stabilization; Email Timeout Extended to 48 Hours

Darkintel Team2 min read

Microsoft says it is seeing early stabilization and capacity improvements in the Microsoft 365 outage that began on Thursday, November 12. The outage disrupted Outlook, Teams, Exchange Online, SharePoint Online, Microsoft 365 Copilot, and other services for users worldwide.

Latest from Microsoft
In its latest update on X, Microsoft said recovery actions are still under way and are starting to show results. To help preserve delayed mail during the incident, Microsoft has extended the email timeout to 48 hours. Microsoft says a more detailed update is available under incident MO1550821 in the Microsoft 365 admin center, or at status.cloud.microsoft for admins who can’t reach the admin center.

What the 48-hour timeout means
During a long outage, emails that can’t be delivered stay in a queue while servers keep retrying. If the queue lasts longer than the timeout window, the messages can expire and bounce back to the sender as undeliverable. Extending the timeout to 48 hours gives Microsoft more time to deliver the backlog before messages expire. Delayed emails are therefore more likely to arrive late than to be lost, provided services recover within that window.

Recap of the incident

  • The outage began at 1:26 p.m. ET on November 12. At its peak, Downdetector logged more than 97,000 Outlook reports, over 38,000 Microsoft 365 reports, and about 4,500 Teams reports.
  • Microsoft first blamed heavy workloads, then found the cause was a number of servers going unexpectedly unavailable, which strained the remaining infrastructure. Servers were failing automated health checks, possibly because of a specific component that processes server health.
  • Microsoft responded by pausing all deployments, moving traffic off affected infrastructure, testing a configuration change, and restarting affected servers.
  • The outage also hit Microsoft connectors used by OpenAI and Anthropic, so AI assistants couldn’t reach users’ mailboxes and data.

Current status
The service is stabilizing but not yet fully restored. Users may still see delays in sending and receiving email and intermittent problems with other Microsoft 365 services while the backlog clears.

Recommendations for IT teams

  • Keep tracking MO1550821 in the Microsoft 365 admin center, or status.cloud.microsoft if the admin center isn’t available.
  • Tell users to expect late emails and to avoid resending messages, which could add to the backlog and cause duplicates.
  • Watch for bounce-backs (NDRs): Any message still undelivered after 48 hours may be returned to the sender and will need to be resent.
  • Check that time-sensitive messages arrived, such as invoices, contracts, and approvals, by confirming with recipients through another channel.
  • Stay alert to outage-themed phishing: Expect fake “Microsoft support,” “mailbox recovery,” or “resend your emails” messages that exploit the disruption.

We will keep updating this post until Microsoft confirms full service restoration and publishes a root cause analysis.

Newsletter

Get the latest cyber news in your inbox

Ransomware, breaches and exploited vulnerabilities, delivered by RansomVault.

Free. No spam. Unsubscribe in one click.

Latest news

How PHP2Shell Works, and Why It Gives Attackers Access Before Your Code Even Runs

Knowledge

PHP2Shell, the pair of critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, has become one of the most heavily exploited bugs of the year. It was exploited four days before PHP released patches on October 21, added to CISA’s Known Exploited Vulnerabilities catalog, and most recently used to break into Check Point Security Gateways and wipe VMware ESXi hosts. But how does it actually work? This post explains the vulnerability in plain terms, using technical research on th

FAA Grounds All U.S. Flights Over Nationwide Air Traffic Control Communications Failure

Threat Intelligence

On Friday afternoon, the Federal Aviation Administration (FAA) ordered a nationwide ground stop at every U.S. airport, citing "extraordinary circumstances" and safety concerns. U.S. Transportation Secretary Sean Duffy said a communications problem was affecting all Air Route Traffic Control Centers across the country. "FAA technicians are investigating the issue. We will provide immediate updates as we have them," Duffy wrote on X. Departing flights must stay on the ground until further noti

PHP2Shell Attacks on Check Point Gateways Deploy Data Wiper on VMware ESXi Hosts

Zero-Day / Threat Intelligence

Threat actors are exploiting vulnerable Check Point Security Gateways in a campaign that ends with data-wiping malware on VMware ESXi hosts. According to Check Point Research, the attacks began on October 30, 2026, first against Israeli organizations. A single actor ran the whole operation, from initial access to lateral movement and destruction. Background: PHP2Shell PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remo

Microsoft 365 Outage Shows Early Signs of Stabilization; Email Timeout Extended to 48 Hours · RansomVault