Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software. This month’s Patch Tuesday addresses 63 critical flaws — including a zero-day in Microsoft Outlook — and comes amid important security updates from other software makers, including Adobe, Apple, Google and Mozilla.

November’s patch release from Redmond tackles 1,093 vulnerabilities, fixing 63 “critical” flaws that can be exploited to seize control over a Windows system with little or no help from users. Nearly half of those critical bugs are remote code execution vulnerabilities. Overall, 535 of the flaws addressed this month allow an attacker to elevate their privileges on a vulnerable device.

This latest round of updates means Microsoft has shipped more than 5,100 security patches so far this year, a staggering number considering that a year ago Microsoft was averaging around 100 patches per month. Microsoft credits advances in artificial intelligence for helping to find (and fix) such a large volume of security bugs in recent months. Last month, Microsoft pushed more than 1,400 fixes.

According to Redmond, just one of the flaws is already seeing active exploitation: CVE-2026-124194, a spoofing bug in Outlook. The advisory for CVE-2026-124194 says it affects Microsoft 365 Apps for Enterprise and editions of Microsoft Office.

Several other major software makers pushed security updates this week to fix critical weaknesses in their products. Apple on Monday released out-of-cycle security updates to fix at least nine vulnerabilities in iOS/iPadOS, macOS, watchOS and visionOS. Among the weaknesses reportedly fixed in Apple’s release include an iMessage flaw that could let a remote attacker join a group chat and receive its messages; the updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined.

Lee Neely, an instructor at the SANS Institute, noted that Apple backported the fix to iOS 18.

“I take notice when Apple releases fixes to more than two versions,” Neely wrote in a SANS newsletter today. “You really need to get to version 27.2.1 of their OSes and push folks who are holding onto devices which cannot run the current version. The best plan often involves setting an upgrade date for old hardware. Run through all your Apple devices and make sure everything is up to date, don’t assume the fixes went out automatically.”

Google this week released Chrome version 157.0.8103.50, which resolves nine security holes, including CVE-2026-125350, the sixth zero-day vulnerability this year for Chrome (this bug also being patched in Chromium-based browsers like Edge). The latest Chrome version follows its November 3 release, which fixed 213 vulnerabilities. A new version of Mozilla Firefox out today (Firefox 160) resolves almost 100 CVEs, about half of them high severity.

Adobe today released patches for at least 110 vulnerabilities across a range of products, with nearly half of the flaws rated high severity. Adobe said there is no evidence any of the security holes it addressed this month are being actively exploited.

Chris Goettl, vice president of product management at Ivanti, said it’s easy for security teams at large enterprises to feel overwhelmed by the volume and criticality of patches from Microsoft lately. But he notes that while some 95,000 vulnerabilities have been assigned CVEs this year across all vendors, only 217 have so far this year been added to the Known Exploited Vulnerabilities (KEV) list maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

“Roughly four in ten of this year’s exploited vulnerabilities sit in operating systems, endpoint software, browsers, and server platforms, which a continuous patch strategy can close quickly,” Goettl said.”The rest calls for exposure management alongside patching, especially the 44% that sit in edge devices and IT management or remote access tools, the internet-facing systems that hold privileged access. Teams that can quickly identify those assets, confirm exposure and act on confirmed exploitation can focus on the small slice of vulnerabilities attackers are actively using, while the rest stays on the normal patch cadence.”

Please don’t neglect to back up any important data if you haven’t recently; generally speaking, this is a task best accomplished before applying operating system updates. As ever, if you experience any issues applying this month’s bundle of love from Microsoft, please drop a comment about it in the space below.

Indian certificate authority eMudhra said Thursday it will stop issuing SSL/TLS certificates days after researchers showed that the private keys securing eight of its certificates were so weak they could be reconstructed in under a second.

The announcement closes an incident where major browsers blocked the certificates and  Indian authorities launched an investigation.  

The company said its board concluded after detailed deliberations that leaving the business was the right decision for eMudhra and its shareholders. Company Chairman V. Srinivasan cited rising costs from data sovereignty and compliance requirements, along with competition from large providers that issue the certificates free of charge. He also said social media amplification of the incident brought scrutiny “out of proportion” to the unit’s place in the company.

“For many certifying authorities, SSL/TLS is the whole business,” the company said. “For eMudhra it is one part of a much broader digital solutions portfolio.”

The episode began last week, when a researcher notified Apple, Google, Microsoft and Mozilla that the private keys of eight eMudhra intermediate certificates could be computed from the public certificates because they were generated with too little randomness. Security researcher Scott Helme recovered all eight on his laptop in less than a second, a task he said an AI agent later repeated from a single prompt.

Normally, a private key is a secret number so large that no computer could ever guess it, roughly 77 or 78 digits long for the type of cryptography used in these certificates. Each of the eight eMudhra keys was a whole number below 256, with one simply logged as the number 4. Since a certificate publicly displays the key it was built from, anyone could test every possible value in seconds, and such keys could be used to forge certificates and impersonate websites.

eMudhra attributed the flaw to an error in a key generation ceremony held April 2025, saying the mistake produced a second, weak set of keys that was published to browser trust lists instead of the intended ones. The company said its infrastructure was not compromised, that no data was breached and that none of the eight intermediates had issued end-entity certificates. Whether anyone used the keys in question is not known.

Chrome and Firefox blocked the certificates within hours of the report, Apple blocked them Monday and Microsoft on Tuesday. Mozilla removed the company’s root certificate from its trusted list, and Google said it will remove that root from Chrome in an update expected next week while it reviews eMudhra’s remaining root certificate. Go, Node.js, Python’s certifi bundle and several Linux distributions also shipped updates.

CERT-In, the country’s computer emergency response team, said it did not see any malicious use of the keys as of Wednesday.

The company said its other businesses, including digital signature and enterprise security services, continue to operate normally, and acknowledged reputational risks it cannot quantify.

Shares of ​the company fell 40% in the two days after the vulnerability was disclosed.

The post eMudhra kills its certificate business after researchers cracked its private keys in under a second appeared first on CyberScoop.

"Mozilla reps tell me they've met with Microsoft about their concerns," reports PC Magazine, "but that the company wasn't responsive." "They'll do the minimum the law requires to respect user choice," explains Kush Amlani, Mozilla's counsel overseeing global competition and regulatory work... Mozilla recently marked 100 days since it released an 87-page report detailing the ways in which Microsoft pushes Edge on Windows PCs.... One example is how Windows often displays a "Let's finish setting up your PC" pop-up after an OS update. This screen has an enabled-by-default option to "use recommended browser settings," which makes Edge the default web browser. However, that screen doesn't appear in Europe. European laws now force Microsoft to make Windows more respectful of user choices. For instance, in European countries, the Start menu opens links in your default web browser rather than in Edge, as it does everywhere else. Amlani says Mozilla wants Microsoft to release the European version of Windows to the rest of the world. However, he thinks this will require government action. As he puts it, "Microsoft can do better when it's forced." The last line of the article sums up Mozilla's main point. "No one should have to fight their OS this hard on something as simple as a browser preference."

Read more of this story at Slashdot.

Mozilla has introduced Firefox Enterprise for organizations with strict compliance, governance, and security requirements.

The post Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise appeared first on SecurityWeek.

Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vulnerabilities in human-made computer code. That reality is on full display this month with some of the more widely-used software makers — including Apple, Google, Microsoft, Mozilla and Oracle — fixing near record volumes of security bugs, and/or quickening the tempo of their patch releases.

As it does on the second Tuesday of every month, Microsoft today released software updates to address at least 118 security vulnerabilities in its various Windows operating systems and other products. Remarkably, this is the first Patch Tuesday in nearly two years that Microsoft is not shipping any fixes to deal with emergency zero-day flaws that are already being exploited. Nor have any of the flaws fixed today been previously disclosed (potentially giving attackers a heads up in how to exploit the weakness).

Sixteen of the vulnerabilities earned Microsoft’s most-dire “critical” label, meaning malware or miscreants could abuse these bugs to seize remote control over a vulnerable Windows device with little or no help from the user. Rapid7 has done much of the heavy lifting in identifying some of the more concerning critical weaknesses this month, including:

• CVE-2026-41089: A critical stack-based buffer overflow in Windows Netlogon that offers an attacker SYSTEM privileges on the domain controller. No privileges or user interaction are required, and attack complexity is low. Patches are available for all versions of Windows Server from 2012 onwards.
• CVE-2026-41096: A critical RCE in the Windows DNS client implementation worthy of attention despite Microsoft assessing exploitation as less likely.
• CVE-2026-41103: A critical elevation of privilege vulnerability that allows an unauthorized attacker to impersonate an existing user by presenting forged credentials, thus bypassing Entra ID. Microsoft expects that exploitation is more likely.

May’s Patch Tuesday is a welcome respite from April, which saw Microsoft fix a near-record 167 security flaws. Microsoft was among a few dozen tech giants given access to a “Project Glasswing,” a much-hyped AI capability developed by Anthropic that appears quite effective at unearthing security vulnerabilities in code.

Apple, another early participant in Project Glasswing, typically fixes an average of 20 vulnerabilities each time it ships a security update for iOS devices, said Chris Goettl, vice president of product management at Ivanti. On May 11, Apple shipped updates to address at least 52 vulnerabilities and backported the changes all the way to iPhone 6s and iOS 15.

Last month, Mozilla released Firefox 150, which resolved a whopping 271 vulnerabilities that were reportedly discovered during the Glasswing evaluation.

“Since Firefox 150.0.0 released, they have been on a more aggressive weekly cadence for security updates including the release of Firefox 150.0.3 on May Patch Tuesday resolving between three to five CVEs in each release,” Goettl said.

The software giant Oracle likewise recently increased its patch pace in response to their work with Glasswing. In its most recent quarterly patch update, Oracle addressed at least 450 flaws, including more than 300 fixes for remotely exploitable, unauthenticated flaws. But at the end of April, Oracle announced it was switching to a monthly update cycle for critical security issues.

On May 8, Google started rolling out updates to its Chrome browser that fixed an astonishing 127 security flaws (up from just 30 the previous month). Chrome automagically downloads available security updates, but installing them requires fully restarting the browser.

If you encounter any weirdness applying the updates from Microsoft or any other vendor mentioned here, feel free to sound off in the comments below. Meantime, if you haven’t backed up your data and/or drive lately, doing that before updating is generally sound advice. For a more granular look at the Microsoft updates released today, checkout this inventory by the SANS Internet Storm Center.