Microsoft patches an actively exploited Outlook zero-day in a 1,000-plus-bug Patch Tuesday; CISA adds six flaws to KEV

Microsoft's November Patch Tuesday is the headline. SecurityWeek reports Microsoft patched 1,094 flaws and that an Outlook zero-day is among them, with Microsoft saying it is aware of active exploitation. Krebs on Security puts the count at nearly 1,100 vulnerabilities, including 63 critical flaws and the Outlook zero-day. The Record lists 1,093 bugs total and says the exploited Outlook vulnerability drew most of the attention. The Register frames it as over 1,000 bugs with one zero-day so far. BleepingComputer reports Microsoft released the Windows 10 KB5131096 extended security update carrying this month's fixes. Prioritise the Outlook update against the rest of the month's load.

CISA (primary source) added six vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. CISA names the Outlook flaw, a Cisco BroadWorks XML external entity vulnerability, two Barracuda Networks issues (an OS command injection across multiple products and an Email Security Gateway authentication bypass), an Openwave Messaging Webtop media transcoder flaw, and a Google Chromium use-after-free. That Chromium bug is CVE-2026-125350, carrying CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and a base score of 8.8. Google's advisory lists Chrome up to the fix in 157.0.8103.50 as affected; follow Google's advisory for that fixed release (https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html). Match each listed product against your estate and apply the updates.

Three more fixes landed the same week. The Hacker News reports Git patched a flaw that lets a malicious repository run an attacker's code during a recursive clone, fixed in Git 2.56.1 with matching backports for the 2.50 through 2.55 series. Help Net Security reports X.Org fixed eight vulnerabilities in the X server and Xwayland, shipping in xorg-server 21.1.26 and xwayland 24.1.15. Schneier on Security reports a new OpenSSH and musl flaw dubbed "*sshole" that lets attackers log in to certain Alpine Linux and other musl-based accounts configured to block password authentication, and notes it has been in the code for a decade.

On breaches, BleepingComputer reports Railway says hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate roughly $740,000 in fraudulent AI usage, potentially exposing credentials for up to 100,000 workspaces. BleepingComputer also reports Japanese retailer Nitori says an attacker accessed a system on its network and stole 37.62 million customer records, and that a threat actor used compromised IAM credentials for a Qubole AWS account to exfiltrate data from multiple customers' AWS environments. The Hacker News reports an attacker exploited a remote code execution flaw in the SGLang inference engine to run code on a NEAR AI inference server, affecting 18 agents and about 100 users. Separately, The Record reports British counterterrorism police, working with the FBI and the US military, arrested an unnamed US Army member in the UK over allegations of spying for Russia.