{"id":815,"date":"2026-11-10T17:44:40","date_gmt":"2026-11-10T23:44:40","guid":{"rendered":"https:\/\/pagesofwisdom.com\/?p=815"},"modified":"2026-11-10T17:44:40","modified_gmt":"2026-11-10T23:44:40","slug":"microsoft-patch-tuesday-outlook-chrome-update","status":"publish","type":"post","link":"https:\/\/pagesofwisdom.com\/index.php\/2026\/11\/10\/microsoft-patch-tuesday-outlook-chrome-update\/","title":{"rendered":"Microsoft Just Fixed 1,000+ Security Holes, and Hackers Already Beat It to One in Outlook. Here’s Your 10-Minute Update Plan"},"content":{"rendered":"\n

Every month, on the second Tuesday, Microsoft drops a big pile of security fixes on the world. Tech folks call it Patch Tuesday. Most of us call it “why is my computer restarting during my Netflix show.”<\/p>\n\n\n\n

This month’s pile, released November 10, is a monster. Microsoft fixed roughly 1,100 security flaws across Windows, Office, and its other products. Tenable<\/a> and The Record<\/a> count 1,093, The Register<\/a> counts 1,094, and BleepingComputer’s tally is 1,235, since outlets count slightly differently. Whatever number you pick, it’s the second month in a row over 1,000. October had 1,474.<\/p>\n\n\n\n

Most of those bugs are the boring, fix-it-quietly kind. But one of them is in Microsoft Outlook, and attackers were already using it before the fix existed. Add a separate Google Chrome flaw that’s also being exploited right now, and you have a good reason to spend ten minutes updating tonight. Here’s what’s going on, in plain English, and exactly what to click.<\/p>\n\n\n\n

The Outlook bug, explained without the jargon<\/h2>\n\n\n\n

The flaw has a name only a robot could love: CVE-2026-124194. Microsoft calls it a “spoofing” bug and gave it a middling severity score of 6.5 out of 10. Don’t let that fool you.<\/p>\n\n\n\n

Here’s how it works, based on Microsoft’s description as reported by The Register and Tenable. An attacker sends you a specially crafted message file and talks you into opening it in Outlook. When you do, Outlook quietly reaches out to a computer the attacker controls, and it skips the warning it would normally show you before loading outside content. During that handshake, your computer hands over a scrambled version of your Windows login, known as an NTLMv2 hash.<\/p>\n\n\n\n

Think of it like a burglar who can’t steal your house key, but tricks you into pressing it into a lump of clay. They walk away with a perfect impression, and with the right tools, they can copy it. The attacker can try to crack that scrambled login or reuse it to pretend to be you on a network.<\/p>\n\n\n\n

“It’s labeled spoofing, but the impact is bigger than the name suggests,” Dustin Childs of TrendAI’s Zero Day Initiative told The Register. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) agreed it’s serious: it added the bug to its list of known exploited flaws and gave federal agencies until the end of the month to patch it, according to The Record<\/a>.<\/p>\n\n\n\n

Fun twist: Microsoft credits the discovery to researcher Beno\u00eet Sevens, who used Anthropic’s Claude AI to help find it. So yes, the robots are now finding bugs faster than the humans can fix them, which may explain the 1,000-plus fixes a month.<\/p>\n\n\n\n

\"Office
Microsoft’s Redmond campus, where this month’s record-size batch of fixes came from. Photo: Jonathan Schilling, via Wikimedia Commons. CC BY-SA 4.0<\/a>.<\/figcaption><\/figure>\n\n\n\n

Who actually needs to worry about it?<\/h2>\n\n\n\n

Ivanti’s breakdown<\/a> says the affected versions include Microsoft 365 Apps for Enterprise and the 2021 and 2024 editions of Office. That means the classic Outlook desktop app that millions of people use at work, and plenty of people use at home. Microsoft hasn’t said who is being attacked or how widely, so you can’t assume you’re too small to be a target.<\/p>\n\n\n\n

If you use Outlook at work, your company’s IT team should be pushing this update out. It doesn’t hurt to restart your work laptop tonight so it can finish installing. If you use Outlook on your own computer, don’t wait for anyone. The update is free, and the button is easy to find (instructions below).<\/p>\n\n\n\n

The Register also flagged two scary-sounding “zero-click” bugs, rated 9.8 out of 10, that need no clicking at all. The good news for regular folks: those mainly hit business email servers and the computers that run company networks, not your home laptop. There’s also a critical fix for the Xbox Live networking service on Windows, so gamers, that one’s your cue too.<\/p>\n\n\n\n

Meanwhile, Chrome has its own emergency<\/h2>\n\n\n\n

On November 9, one day before Patch Tuesday, Google pushed out Chrome version 157.0.8103.50 (or .51) to fix nine security bugs. One of them, CVE-2026-125350, is a memory flaw in how Chrome reads a type of web data called XML. In Google’s own words on the Chrome Releases blog<\/a>: “Google is aware that an exploit for CVE-2026-125350 exists in the wild.” Translation: bad guys already have a working attack.<\/p>\n\n\n\n

SecurityWeek<\/a> notes this is the eighth Chrome zero-day of 2026. Google hasn’t shared who’s behind the attacks or what they do. Chrome updates itself, but Malwarebytes points out<\/a> a catch: if you never fully close your browser, the update just sits there waiting. If you’re the kind of person with 47 tabs open since August, this means you. Ivanti adds that other browsers built on the same engine as Chrome, like Microsoft Edge, need the fix as well.<\/p>\n\n\n\n

\"A
A made-up example of a phishing email. Attacks like the Outlook bug start with a message that pushes you to open or click something. Image: Isochrone, Wikimedia Foundation, Philip Metschan, via Wikimedia Commons. CC BY-SA 4.0<\/a>.<\/figcaption><\/figure>\n\n\n\n

Your 10-minute update plan<\/h2>\n\n\n\n

Grab a coffee. Save anything you’re working on. Then go down this list:<\/p>\n\n\n\n

    \n
  1. Windows:<\/strong> Click Start, open Settings, choose Windows Update, and click Check for updates. Install everything it finds, then restart. Yes, actually restart. Updates don’t finish until you do.<\/li>\n\n
  2. Outlook and Office on Windows:<\/strong> Open Outlook (or Word), click File, then Account (in Outlook it may say Office Account), then Update Options, then Update Now. Let it finish and reopen Outlook.<\/li>\n\n
  3. Office on a Mac:<\/strong> Open any Office app, click Help in the menu bar, then Check for Updates.<\/li>\n\n
  4. Chrome:<\/strong> Click the three dots in the top-right corner, go to Help, then About Google Chrome. It will check and download the update. Click Relaunch when it appears.<\/li>\n\n
  5. Edge:<\/strong> Click the three dots, go to Help and feedback, then About Microsoft Edge. Restart it when it asks.<\/li>\n\n
  6. Your phone:<\/strong> Update Chrome from the Google Play Store or App Store. Android owners should also check Settings for a system update; Google’s November Android security patch fixed 216 bugs, per Ivanti.<\/li>\n<\/ol>\n\n\n\n

    One more sneaky spot: Microsoft Store apps like Paint update separately from Windows Update. We covered that in our post on Microsoft Paint’s security fix<\/a>, and it’s worth a peek while you’re already in update mode.<\/p>\n\n\n\n

    Habits that stop the next one<\/h2>\n\n\n\n

    Patches fix the holes you know about. Good habits protect you from the ones nobody’s found yet.<\/p>\n\n\n\n