ITsecurity Daily
Daily Briefing
Microsoft patches an actively exploited Outlook zero-day in a 1,000-plus-bug Patch Tuesday; CISA adds six flaws to KEV
Good morning. Microsoft's November Patch Tuesday is the headline. SecurityWeek reports Microsoft patched 1,094 flaws and that an Outlook zero-day is among them, with Microsoft saying it is aware of active exploitation. Krebs on Security puts the count at nearly 1,100 vulnerabilities, including 63 critical flaws and the Outlook zero-day. The Record lists 1,093 bugs total and says the exploited Outlook vulnerability drew most of the attention. The Register frames it as over 1,000 bugs with one zero-day so far. BleepingComputer reports Microsoft released the Windows 10 KB5131096 extended security update carrying this month's fixes. Prioritise the Outlook update against the rest of the month's load.
CISA (primary source) added six vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. CISA names the Outlook flaw, a Cisco BroadWorks XML external entity vulnerability, two Barracuda Networks issues (an OS command injection across multiple products and an Email Security Gateway authentication bypass), an Openwave Messaging Webtop media transcoder flaw, and a Google Chromium use-after-free. That Chromium bug is CVE-2026-125350, carrying CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and a base score of 8.8. Google's advisory lists Chrome up to the fix in 157.0.8103.50 as affected; follow Google's advisory for that fixed release (https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html). Match each listed product against your estate and apply the updates.
Three more fixes landed the same week. The Hacker News reports Git patched a flaw that lets a malicious repository run an attacker's code during a recursive clone, fixed in Git 2.56.1 with matching backports for the 2.50 through 2.55 series. Help Net Security reports X.Org fixed eight vulnerabilities in the X server and Xwayland, shipping in xorg-server 21.1.26 and xwayland 24.1.15. Schneier on Security reports a new OpenSSH and musl flaw dubbed "*sshole" that lets attackers log in to certain Alpine Linux and other musl-based accounts configured to block password authentication, and notes it has been in the code for a decade.
Zoom out: The Record reports Microsoft's Patch Tuesday surpassed 1,000 bugs for the second month in a row.
Vulnerability in focus
CVE-2026-125350 — Google. CVSS 8.8 CISA lists it as known to be exploited.
Affected: chrome.
What to do: Follow the vendor advisory for the fixed release and any interim mitigation.
Elsewhere
- The Hacker News: Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches Read it
- Help Net Security: EU cyber scores look healthy, but 45% of surveyed IT providers take months to patch Read it
- Help Net Security: Nearly half of big firms shelve or close vulnerability findings they haven’t confirmed Read it
- Help Net Security: Google Fi super network leans on encryption to keep hotspot traffic private Read it
- Help Net Security: An Instagram ad was all it took: Leaked exploit kits are hitting employees’ iPhones Read it
- The Register: November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far Read it
- BleepingComputer: Railway breach leads to $740,000 in fraudulent AI charges Read it
- Krebs on Security: Microsoft Fixes Nearly 1,100 Security Vulnerabilities Read it
- The Record: US Army member arrested in UK over allegations of spying for Russia Read it
- The Record: Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row Read it
- BleepingComputer: Japanese furniture giant Nitori says hackers stole 37.6M customer records Read it
More from the desk
Sources
- November Patch Tuesday boasts over 1,000 bugs but only one zero-day so far The Register
- Railway breach leads to $740,000 in fraudulent AI charges BleepingComputer
- Microsoft Fixes Nearly 1,100 Security Vulnerabilities Krebs on Security
- US Army member arrested in UK over allegations of spying for Russia The Record
- Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones The Hacker News
- Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft SecurityWeek
- X.Org patches eight server vulnerabilities a month after fixing 12 others Help Net Security
- New OpenSSH Vulnerability Schneier on Security
- CISA Adds Six Known Exploited Vulnerabilities to Catalog CISA
- Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row The Record
- Japanese furniture giant Nitori says hackers stole 37.6M customer records BleepingComputer
- Microsoft releases Windows 10 KB5131096 extended security update BleepingComputer
- Hackers exploit trusted AWS access to breach multiple cloud environments BleepingComputer
- SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users The Hacker News
Share this issue
Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky
Every briefing is on the site, with the advisory record behind it. All briefings