Microsoft’s Four-Digit Patch Tuesday Lands as SSH Flaw Is Exploited
Microsoft's November Patch Tuesday fixed nearly 1,100 vulnerabilities, with one Outlook bug already under attack. The same week, attackers began exploiting a newly numbered OpenSSH flaw that mostly affects Alpine Linux, and Apple, Chrome, Firefox and Adobe all shipped fixes.
Microsoft's November Patch Tuesday fixed nearly 1,100 vulnerabilities, making it the headline of a week in security defined by a four-digit patch count. Of those, 63 are rated critical and more than 500 let an attacker gain higher privileges on a machine.
Only one is reported as actively exploited. CVE-2026-124194 is a spoofing bug in Outlook, and Microsoft's advice for most users is simple: install the update, starting with Outlook.
A record year for fixes
Microsoft has now shipped more than 5,100 security fixes this year. Last month's release alone topped 1,400. Last year's average was around 100 a month.
The article that tallied the figures credits AI tools for the surge, both in bugs fixed and in bugs found. Last month's release also included a remote code execution bug in Windows Paint (CVE-2026-83844), though its own description admits the code runs locally.
Other vendors are busy too. Apple pushed out-of-cycle updates for at least nine vulnerabilities, including an iMessage flaw that could let a remote attacker join a group chat and read its messages. Apple also backported the fixes to iOS 18.
Chrome 157 fixes another zero-day, CVE-2026-125350, a week after a release that fixed more than 200 bugs. Firefox 160 fixes almost 100 CVEs, Adobe fixed more than 110, and zlib 1.4 shipped with more than a dozen security fixes.
Where to start
Roughly 95,000 CVEs have been assigned this year. Only around 200 have made it onto the US Cybersecurity and Infrastructure Security Agency's list of known exploited vulnerabilities, known as KEV. If you must prioritize, start there.
OpenSSH flaw now under attack
The OpenSSH bug nicknamed sshole now has a number, CVE-2026-123158. On OpenSSH running on musl libc without PAM, any sufficiently long password is accepted for accounts that should not take a password at all.
Security firm GreyNoise said honeypots it runs in Southeast Asia were hit by a group it tracks as GT10. The group installed Python to run a backdoor with Chinese-language comments that appears to have been written with AI. WatchTowr reports exploitation tied to botnets and cryptocurrency, and Previdian has seen attempts from thirteen IP addresses in nine countries.
CISA added the flaw to its KEV catalog on November 9. It gave federal agencies just three days to patch.
Kevin Beaumont says the exposed population in practice looks like Alpine Linux. Debian, Ubuntu, SUSE, Red Hat and CentOS are not affected, nor is stock OpenWrt, which uses Dropbear instead of OpenSSH.
The researcher who found the bug suggests checking other musl-based systems with OpenSSH installed, such as Buildroot and Yocto, along with "a lot of the docker images you’ve pulled."
The OpenSSH 10.6p2 release notes credit Özgün Kültekin of Wakefield with the report. The OpenSSH team says it has "seen a number of cases where a security bug identified by AI tools is subsequently independently discovered by a different researcher." It will now make more frequent releases instead of batching fixes.
