Microsoft patched an exploited Outlook zero-day used to steal Windows authentication hashes among 1,094 fixes; Google fixed the eighth exploited Chrome zero-day of 2026 (Brave shipped the fix too); Barracuda confirms a small number of organizations hit through two chained Email Security Gateway flaws giving root; CISA added six CVEs to KEV.
What to do: Nov 11: Barracuda disclosed the two chained ESG flaws Nov 3; exploitation confirmed Nov 10 and added to KEV (see kev-nov-10 card).
🛡️️️We added 6 CVEs to our Known Exploited Vulnerabilities Catalog. Visit & apply mitigations to protect your org. #Cybersecurity #InfoSec
🚨 Microsoft confirms hackers are exploiting Outlook zero-day to steal Windows authentication hashes, CVE-2026-124194 Microsoft has patched an actively exploited vulnerability in Outlook that could allow attackers to steal NTLM authentication hashes by trickin
Google patches eighth Chrome zero-day exploited in attacks this year
🚨 8 Chrome zero-days exploited in the wild in 2026. Google has now released a security update for the latest one: CVE-2026-125350, a high-severity use-after-free flaw in Chrome's XML component. An exploit exists in the wild. Attack details remain undisclosed
Today’s browser update (v1.99.56) contains a fix for a Chromium vulnerability found to be exploited in the wild. You may have received the automatic Brave update already. If not, you can manually update by visiting ‘About Brave’ from the browser’s ☰ menu.
Hackers now exploit critical Barracuda ESG flaws to gain root access
Why this score
Plan rubric with caps (verified sweep, Nov 11)