When services stop: the wave of attacks and failures bringing down the digital world

Analysis — On Thursday, November 12, email stopped. Microsoft 365 was down for about 18 hours worldwide: Outlook, Teams, SharePoint, OneDrive and Copilot. It was not an attack — it was a fault introduced during a network capacity upgrade. And that is the story: 2026 is the year the services we cannot live without started stopping all the time. Sometimes because of attacks and failures by intruders. Most of the time, broken by themselves — by a routine change, a command, a data center hall hitting 44°C. The digital world is not being brought down only by hackers. It is tripping over its own feet — and the attacks just take advantage of the fall.

This is an analysis: the facts are verified and listed in the sources at the end; the reading of them — what this year says about the fragility of services — is Geekiki's opinion.

The week email stopped

The Microsoft 365 outage began around 13:17 Brasília time on Thursday (12). Within hours, Downdetector was recording almost 130,000 complaints about Outlook alone. Email, meetings, files and Microsoft's AI assistant, all down together. The company's explanation changed three times in under 24 hours: first, elevated load from unavailable servers; then, an overwhelmed secure-connection process and the rollback of a network change; finally, a fault from an earlier network capacity upgrade, surfaced by a recent change. What did not change: it was not a cyberattack, it had nothing to do with AI or agents, and the incident was still not declared closed on Friday night (13), with the full report promised and no date. It was the second multi-hour Microsoft 365 outage in under three months — covered by Geekiki here: Microsoft 365 back online after 18-hour outage.

It was not just Microsoft

The 2026 list reads like a war bulletin — but against the infrastructure itself:

  • Cloudflare, February 20: a filter deleted the prefixes it was meant to protect; 1,100 customer routes gone for 5 hours.
  • Azure, July 23: traffic in and out of the US West region failed for 5 hours. The safety check that was supposed to keep a redundant path up ran — and passed — because it judged each device alone.
  • Azure, May: an internal Microsoft 365 client retried capacity errors with no backoff, up to 48 extra attempts — and in the same week, lightning locked the cooling out of a data center, which stayed down for 22 hours.
  • Google Cloud, July 15: a 3-millisecond power sag tripped breakers in the Netherlands; the hall reached 44°C and staff had to shut machines down by hand. More than 14 hours of disruption.
  • AWS, May 7–8: cooling failure at Amazon's biggest data center, in Virginia; 21 and a half hours to majority recovery.
  • Google Cloud, October 19–20: power event in a London zone, 7 hours 52 minutes.
  • Cloudflare One, October 19: 3 hours 12 minutes of global disruption.
  • Copilot, June: two major outages of Microsoft's AI assistant, which already has more than 20 million paid subscribers.
  • Claude, April 15: elevated error rates across Anthropic's chatbot, coding assistant and API.
  • AWS, Middle East, March: drone strikes hit facilities in the UAE and Bahrain regions. Both regions still cannot reliably support applications — and some data stored only there cannot be restored.

That is 39 major cloud and infrastructure outages in 2026 alone, according to a tracker that only counts incidents documented by the operators themselves — and 62 since 2020, with a median duration of 6 hours 12 minutes. The most common cause is neither hardware nor attack: it is configuration or deployment change, 32% of cases. A Splunk (Cisco) study estimates the world's largest companies lose an average of US$ 300 million a year to unplanned outages — about US$ 15,000 per minute.

And when it is an attack, it keeps getting bigger

While services fall on their own, attacks are breaking records. In October 2026 alone, there were 1,020 ransomware attacks — almost 33 a day, the second-highest number of the year. The most active gangs, Qilin and The Gentlemen, accounted for 264 attacks in the month. Some recent cases:

  • GMO Internet, Japan, October: an attack on a technology company that disrupted several other companies.
  • Vanderbilt University, US, November 9: attack by the BYOD group, claiming more than 1 million stolen Social Security numbers.
  • Texas, US, November: the same BYOD group says it holds data on about 2 million Texans from the state health agency — still unconfirmed.
  • Fireworks AI, October: two intrusions, on October 6 and 23, exposing customer account, billing, secrets and payment-history data.
  • Unitel, Angola, July: almost three weeks to restore most services.
  • Brazil: Binance lost US$ 6.3 billion in an attack on October 29 (read here); Mercado Bitcoin confirmed an attack on November 2, with an estimate of more than US$ 40 million in suspicious transfers (read here); Caixa Vida e Previdência had data on 7.6 million clients exposed on November 12 (read here); and the National Treasury, the same day, about 30,000 registrations and 4,000 Pix keys (read here).

The flaw that almost stopped the internet

In the middle of all this, one vulnerability showed the scale of the problem. PHP2Shell is two critical flaws in PHP — CVE-2026-109618 and CVE-2026-109619, rated 9.2 — found with the help of AI models, allowing code execution on a server with no login. Since PHP runs on about 69% of the world's websites, the estimate was more than 22.6 million exposed servers. Exploitation attempts began on October 17, four days before the fix; the patches shipped on October 21. Governments and companies took sites offline as a precaution — 32 services in the UK, the DigiD login in the Netherlands, sites in Finland, France and Denmark. By October 24, there was no confirmed breach linked to the flaw — but the scare alone had already stopped half the world. Geekiki covered the discovery: AI finds critical PHP flaws affecting 70% of the web (PHP2Shell).

The pattern: two fragilities, one problem

First: services can be attacked — and they are, more and more. Ransomware has become an industry: 1,020 attacks in one month, gangs with names, leak sites and negotiations. AI has accelerated both sides: PHP2Shell was found with AI's help, and attacks get faster and cheaper to mount. Stolen data has become merchandise — and Brazil, with Binance, Mercado Bitcoin, Caixa and the Treasury within two weeks, felt it firsthand.

Second: services break on their own — and that is the bigger cause. Of fourteen major outages analyzed between 2008 and 2026, eleven began with a routine change: a command, a firewall rule, a content update, a permission, a cleanup job. None of the eleven was an attack. The size of the outage came from where the change landed, not from the change itself. One command in the wrong place, and the world's email stops. One breaker, and a data center hits 44°C. One lightning strike, and 22 hours offline.

And the thread connecting both sides is concentration. Almost everything runs through a handful of providers — Microsoft, Amazon, Google, Cloudflare. When one of them fails, thousands of services fall together; when one of them is attacked, the damage is global. And when something goes wrong, the response follows the same script: switch off, contain, and tell the public afterwards — Microsoft changed its explanation three times in 24 hours; the Treasury told the public eight days after detecting the breach.

What remains

The lesson of 2026 is not that the internet is under attack — it always has been. It is that the internet is too concentrated and too fragile for the weight it carries. Email, meetings, files, payments, government services: everything depends on the same few systems, which can be breached and which can break on their own. And the bill, in both cases, lands on the user: work stopped, a deadline missed, exposed data that later becomes a scam.

What to watch in the coming weeks: Microsoft's full report on the November outage; whether the AWS regions in the Middle East return to normal operation; whether any confirmed breach linked to PHP2Shell emerges; and whether October's ransomware pace holds. The question is not whether it will stop again — it is what, and why, will stop next time.

Sources

Featured image: Outlook icon (Microsoft, via Wikimedia Commons, CC BY-SA 4.0).

This content was produced with the assistance of artificial intelligence and reviewed editorially.

By Muse