Tech news, 13 November 2026: a long Microsoft 365 outage, EU rules for AI sandboxes, an exploited Xen Orchestra flaw and Nebius's spending plans

1. Microsoft 365 suffers a long outage

Outlook, Exchange Online, Teams and other Microsoft 365 services were disrupted for much of 12 November; Microsoft said servers failing automated health checks dropped out of service and pushed load onto remaining infrastructure across several regions, and reported no evidence of a cyberattack¹. XDA reports Microsoft paused deployments while preparing a configuration change to relieve an overwhelmed connection process².

CTO take: most companies now depend on one productivity suite for email, chat, files and increasingly AI assistants. You cannot prevent a supplier outage, but you can plan for it: an out-of-band way to reach staff and customers, critical contacts and runbooks available offline, and a clear decision on which processes stop and which continue. Review what broke for you on 12 November while it is fresh. See the supplier resilience case study.

2. The EU sets common rules for AI regulatory sandboxes

The European Commission adopted Implementing Regulation (EU) 2026/2487, published on 11 November, setting common rules for establishing and running national AI regulatory sandboxes under the AI Act³. EU Law Live reports the rules cover how sandboxes are set up, operated and supervised⁴; commentary notes participation produces documentation and an exit report rather than any compliance clearance.

CTO take: sandboxes are useful for testing novel AI systems with a regulator watching, especially for smaller companies, but they are not a shortcut to compliance. If you build high-risk AI for the EU, consider a sandbox for genuinely uncertain questions, and keep building your own evidence: risk assessments, evaluations and documentation. See the Europe page and the AI governance programme case study.

3. An exploited Xen Orchestra flaw exposes virtualisation hosts

Vates published advisory VSA-2026-062 on 10 November for an actively exploited authentication bypass in Xen Orchestra that lets attackers gain administrative access and take over XCP-ng hosts; SC Media reports exploitation leaves little trace in Xen Orchestra's own logs⁵.

CTO take: management consoles for virtualisation, backup and networking are the keys to everything beneath them, and many teams that moved to open-source hypervisors run them with less scrutiny than their old platforms. Patch to the fixed versions in the advisory, keep management interfaces off the internet and behind strong access controls, and check hosts for signs of compromise. See the management plane hardening case study.

4. Nebius raises spending plans as AI cloud capacity gets costlier

Nebius reported third-quarter results on 11 November and its shares fell the next day; it raised its 2026 capital spending forecast and guided 2026 revenue to the low end of its range, Investing.com reports⁶.

CTO take: specialist AI clouds are spending heavily ahead of revenue. For buyers, that can mean good prices today and more uncertainty later. Diversify across providers, prefer contracts that let you move, and watch the financial health of any provider you rely on for production capacity. See AI capacity contracts.

What I'd do this week

• Hold a short review of how the Microsoft 365 outage affected you and what you would do differently.
• Patch Xen Orchestra and confirm management consoles are not internet-facing.
• Decide whether any EU AI work would benefit from a regulatory sandbox.
• Check the financial outlook of AI cloud providers you depend on.

I am based in India, the United States and the UAE, working globally. See where I work, or analyse your challenge and bring the result to a call.