Menu
Passengers checking an airport departure board, illustrating the FAA nationwide ground stop.

FAA Ground Stop, Plus 4 More Tech Stories

, , , , , , ,

The FAA nationwide ground stop is the biggest technology story today, not because it involved a clever attack, but because it apparently didn’t. A routine network change and aging equipment were enough to halt departures across the country. The rest of today’s brief follows the same uncomfortable theme: the system you depend on can become the point where everything else stops.

A network change helped ground U.S. flights nationwide

The Federal Aviation Administration stopped every departing flight in the United States for more than four hours Friday after instability appeared in the communications and radar data used by air traffic controllers. Flights already in the air continued toward safe landings while the FAA reduced the number of aircraft aloft and tested the system. Departures began again around 8:15 p.m. Eastern, but displaced aircraft and crews are still producing cancellations and delays Saturday.

So what failed? The official answer is still preliminary. The FAA described communications problems affecting multiple control centers. Transportation Secretary Sean Duffy said older switches and routers became overloaded and began producing inconsistent information. CBS News reported that an update to the private network connecting the air traffic system triggered a reboot and crash, while Homeland Security Secretary Markwayne Mullin said security patches and new equipment appeared to overwhelm the older system. Officials say there’s no evidence of a cyberattack, and the FAA’s new AI advisory system wasn’t involved.

That distinction matters. Cyberattacks make better headlines, but an ordinary change can cause the same human disruption when a safety-critical system has too little isolation, capacity, or room to fail. The stop affected travelers, cargo, airline crews, airport gates, and every business waiting for a person or package. It also shows why “legacy system” can’t just mean old hardware that somebody ought to replace eventually. A replacement has to coexist with the old network while the work is underway, and that transition is often where the interesting failures live.

If you’re traveling, confirm the flight with the airline before leaving and expect the recovery to outlast the original outage. For everyone else, there isn’t a security setting to change. The business lesson is to test changes against the actual load, define what happens when the change goes wrong, and keep a rollback path that doesn’t depend on the failing system. Boring change control rarely makes the news. Its absence certainly can.

Business IT goes well beyond the website

Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.

Check Point gateways were a path to an ESXi wiper

Check Point says attackers have been exploiting internet-facing Security Gateways since October 30. The chain begins with PHP2Shell, two flaws in the Mobile Access Portal that allow unauthenticated remote code execution. The attackers then used CVE-2026-123039, a flaw in Gaia OS’s DynamicCLI service, to climb from the portal account to root. Root on a firewall is not merely root on one box. It gives an attacker a trusted position at the edge of the network.

In the destructive cases Check Point investigated, the attackers installed webshells and a persistent backdoor, moved over SSH to VMware ESXi hosts, and deployed a wiper. That is the part businesses should sit with for a moment. The security gateway did not contain the incident. It became the route into the virtualization layer where many servers live.

Check Point is telling customers to install the November Jumbo Hotfix on affected gateways and management servers. CISA has also added CVE-2026-123039 to its exploited-vulnerability catalog. If you operate Check Point R80 through R82.20 products, verify the specific hotfix for your version, review Check Point’s indicators of compromise, and investigate before treating installation as proof that the system was never breached. Then ask who can erase the backups as well as the live virtual machines. A backup controlled from the same compromised administrative path isn’t much of an escape hatch.

Microsoft 365 recovered, but continuity is still your job

Microsoft says the worldwide Microsoft 365 outage that began Thursday was a technical failure, not a cyberattack or an AI-agent incident. The company traced it to an earlier network-capacity upgrade whose problem surfaced after a later network change. Exchange Online took the center of the impact, which meant Outlook access and email delivery suffered while dependent features in Teams, Copilot, Defender, SharePoint, Universal Print, Windows 365, and other services also failed or degraded.

Recovery was broad by Friday, although delayed mail and regional problems took longer to clear. No one needs to migrate an entire company because one cloud service had a bad day. Businesses should have one independent way to reach employees, customers, and key vendors when Microsoft identity, email, or status tools aren’t available. Keep current contact information outside the tenant, decide which work can wait, and know where you’ll post an update. Redundancy doesn’t mean buying the same dependency twice under two product names.

Backups & recovery

Backups are comforting right up until you need one. Raymond Tec helps small businesses build practical backup and recovery plans — including the decidedly unglamorous part where we make sure the thing can actually be restored.

Uber drivers’ license data was exposed through an AI vendor

Uber is notifying drivers that an attacker accessed personal information through credentials stolen from Fireworks AI, the same infrastructure provider involved in the Notion incident we covered this week. State filings say the exposed material included images of drivers’ licenses and extracted text such as names, addresses, dates of birth, and license numbers. Published state totals already reach into the thousands, but Uber hasn’t released a national count.

The provider had legitimate access to an Uber cloud storage environment created for its work. That’s why this wasn’t stopped by asking whether Fireworks could log in. It was supposed to log in. The harder question is whether the vendor needed that much identity data, how long it needed it, and what control could detect a valid credential being used for the wrong purpose.

Uber says it cut the provider connection, rotated access information, and has found no evidence of misuse. If you receive a notice, use the offered monitoring and watch for identity-related fraud. For businesses, this is the practical AI-governance question hiding underneath the breach story: which vendors can retrieve customer or employee records after the demo becomes a production workflow? “It’s an AI tool” doesn’t make ordinary data-minimization and access reviews optional.

Turning on AI is the easy part

Deciding what an AI tool should be allowed to see, who should use it, what work it should perform, and what happens when it gets something wrong is the more interesting problem. Raymond Tec helps businesses connect and automate the tools they actually use without treating every new feature like a button that obviously needs to be switched on.

PostgreSQL’s update includes a backup warning

PostgreSQL has released versions 18.7, 17.12, 16.16, 15.20, and 14.25 with fixes for 52 security vulnerabilities and more than 140 bugs. The most serious listed flaw, CVE-2026-6460, can let a database user with permission to create objects turn a type-confusion bug into code execution. There are no reports of active exploitation, so this is planned urgent maintenance rather than an incident response.

The release notes contain two details worth more than the headline number. Several index-corruption fixes may require REINDEX work, and PostgreSQL says existing incremental backup files shouldn’t be trusted because multiple bugs could corrupt them. After updating, take a new full backup before building another incremental chain. Also, 14.25 is the final PostgreSQL 14 release. If a production system is still on 14, it now needs an upgrade plan rather than another promise to revisit the problem next quarter.

Database owners should apply the supported release, read the version-specific migration notes, rebuild affected indexes, and verify a fresh backup. A patch closes vulnerabilities. It doesn’t repair a backup chain you can no longer trust.

Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.

Sources / Further Reading

Photo by AirTeo | Air Travel on Pexels.

Related Posts

Leave a Reply

Only people in my network can comment.