MeridianMeridian

Microsoft Issues Record November Patch Tuesday Fixing 1,093 Vulnerabilities Including Outlook Zero-Day

Microsoft released its November Patch Tuesday update addressing 1,093 security vulnerabilities across Windows and supported software. The release includes 63 critical flaws, nearly half of which are remote code execution issues that could allow attackers to take control of systems. One actively exploited zero-day, CVE-2026-124194, affects Microsoft Outlook and Microsoft 365 Apps. Other vendors including Apple, Google, Mozilla, and Adobe also issued important security updates this week. Microsoft attributes the high volume of fixes to advances in artificial intelligence used for vulnerability discovery. Security experts note that while the number of patches is large, only a small fraction appear on CISA’s Known Exploited Vulnerabilities list, emphasizing the need for prioritized patching and exposure management.

Krebs on SecurityTranslated from English

Read at source

Microsoft delivered another large-scale Patch Tuesday release this month, shipping fixes for 1,093 security vulnerabilities in Windows operating systems and related software products.

The November update resolves 63 critical flaws that could allow attackers to seize control of vulnerable systems with little or no user interaction. Nearly half of these critical issues are remote code execution vulnerabilities. In total, 535 of the addressed flaws permit privilege escalation on affected devices.

Microsoft has now issued more than 5,100 security patches in 2026, a sharp increase from the roughly 100 patches per month averaged a year earlier. The company credits improvements in artificial intelligence for enabling faster discovery and remediation of such a high volume of bugs. Last month alone, Redmond released over 1,400 fixes.

One vulnerability, CVE-2026-124194, is already under active exploitation. This spoofing flaw affects Microsoft 365 Apps for Enterprise and various editions of Microsoft Office.

Several other major vendors also released security updates this week. Apple issued out-of-cycle patches for at least nine vulnerabilities across iOS/iPadOS, macOS, watchOS, and visionOS, including two iMessage flaws that could allow unauthorized access to group chat messages. The fixes were backported to iOS 18.

Google released Chrome 157.0.8103.50, fixing nine issues including the zero-day CVE-2026-125350, the sixth actively exploited Chrome vulnerability this year. Mozilla shipped Firefox 160 with nearly 100 CVEs resolved. Adobe patched at least 110 vulnerabilities across its product line, with no evidence of active exploitation reported.

MicrosoftAppleChromeAdobeFirefoxCVE-2026-125350CVE-2026-124194
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

CISA Adds Six Known Exploited Vulnerabilities to Catalog
Vulns & Exploits

CISA Adds Six Known Exploited Vulnerabilities to Catalog

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities Catalog based on confirmed active exploitation in the wild. The list includes flaws affecting Cisco BroadWorks, multiple Barracuda Networks products, Openwave Messaging Webtop Media Transcoder, Microsoft Office Outlook, and Google Chromium. These vulnerabilities enable attacks such as XML external entity injection, OS command injection, authentication bypass, and use-after-free exploitation. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize remediation of KEV-listed issues on publicly exposed assets that could grant full system control. CISA encourages all organizations to adopt similar risk-based vulnerability management practices. The agency continues to accept nominations for additional exploited vulnerabilities through its official form.

CISA AlertsNov 10, 2026Translated from English

Microsoft Releases Windows 10 KB5131096 Extended Security Update with November 2026 Patch Tuesday Fixes
Vulns & Exploits

Microsoft Releases Windows 10 KB5131096 Extended Security Update with November 2026 Patch Tuesday Fixes

Microsoft has released the Windows 10 KB5131096 extended security update, delivering this month's November 2026 Patch Tuesday fixes along with additional bug fixes and changes. The update applies to Windows 10 Enterprise LTSC users and those enrolled in the ESU program, bringing systems to build 19045.7846 for standard Windows 10 and 19044.7846 for Windows 10 Enterprise LTSC 2021. Among the fixes is resolution for an actively exploited Outlook zero-day flaw as part of addressing 1,235 vulnerabilities across Microsoft products. The update also corrects daylight saving time rules for Cuba, resolves printer installation errors in Active Directory environments, and fixes Remote Desktop policy and shadow connection issues on Windows Server 2016 and 2012 R2. Additional changes strengthen PowerShell script signing security through stricter UTF-8 encoding validation and resolve remaining USB Audio Class 1.0 device problems that caused audio failures and Code 10 errors.

BleepingComputerNov 10, 2026Translated from English

SGLang RCE Exploit Breaches NEAR AI Inference Servers, Exposing Data from 18 Agents and 100 Users
Vulns & Exploits

SGLang RCE Exploit Breaches NEAR AI Inference Servers, Exposing Data from 18 Agents and 100 Users

An attacker exploited a remote code execution vulnerability in SGLang, an open-source inference engine, to compromise one of NEAR AI's inference servers last Sunday. The intrusion allowed access to requests processed that day, including those handled in confidential mode inside a trusted execution environment. Although the TEE was intended to protect privacy, the flaw in SGLang running inside it enabled the attacker to reach sensitive data. The intruder then moved laterally to an internal system behind the deprecated Private Chat product, downloading account details for roughly 100 users. Eighteen AI agents on an older NEAR AI Agents deployment outside the TEE were also compromised, resulting in the theft of chat histories, settings, and logs. Two NEAR AI Cloud API keys were exposed in logs and subsequently revoked. NEAR AI has since revoked sessions, replaced tokens, deployed a SGLang fix across servers, and completed forensic review while notifying affected users.

The Hacker NewsNov 10, 2026Translated from English