November 2026 Security Updates: Chrome and Outlook Zero-Days and What to Patch First

November 2026 is a big month for security updates. Microsoft's Patch Tuesday on 10 November fixed more than 1,090 vulnerabilities, the largest release on record, including an Outlook bug that attackers were already using. Google patched an actively exploited Chrome zero-day the day before, and PHP sites are still catching up on the PHP2Shell fixes from October. Here's what matters, in priority order, and how to install each fix.

Patch these first

The US agency CISA added both the Chrome and the Outlook bug to its Known Exploited Vulnerabilities list on 10 November, with a patch deadline of 24 November 2026 for federal agencies. That's a good deadline for everyone else too.

Chrome zero-day: CVE-2026-125350

On 9 November Google released Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. The update fixes 9 security bugs, including CVE-2026-125350, a high-severity use-after-free in Chrome's XML handling. Google says it "is aware that an exploit for CVE-2026-125350 exists in the wild." Visiting a malicious web page could be enough to trigger it.

How to update Chrome

1. Open chrome://settings/help in the address bar.
2. Chrome checks for updates and downloads them automatically.
3. Click Relaunch. The update isn't active until you restart the browser.
4. Confirm the version is 157.0.8103.50 or later.

Microsoft Edge, Brave, Opera and Vivaldi are all built on Chromium. Update them too, using their own "About" pages, as their vendors ship the fix.

On Windows you can update several browsers at once with winget:

winget upgrade Google.Chrome Microsoft.Edge
winget upgrade --all   # or update everything that has an update

Outlook zero-day: CVE-2026-124194

This is the only Patch Tuesday bug Microsoft marked as exploited. When a user opens a specially crafted file, Outlook connects to a server the attacker controls without showing the usual external-content warning. During that connection Windows sends the user's NTLMv2 hash, a fingerprint of their password. Attackers can try to crack the hash offline or relay it to log in to other systems as that user.

• Severity: CVSS 6.5 (rated Moderate), but actively used in attacks.
• Per Microsoft's FAQ, as reported by SecurityOnline, the Preview Pane is not an attack vector: the user has to open the file.
• Microsoft has not published indicators of compromise.

How to update Office and Outlook

For Microsoft 365 and Office 2021/2024 (Click-to-Run):

1. Open any Office app, then File > Account > Update Options > Update Now.
2. Or start an update from the command line:

"C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe" /update user

For Office LTSC 2021 and LTSC 2024, SecurityOnline lists the fixed builds as 16.0.14334.21048 and 16.0.17932.21140. Check yours under File > Account > About Outlook.

Extra protection: stop NTLM hashes leaving your network

NTLM hash leaks are a recurring Outlook and Windows attack pattern. Blocking outbound SMB (TCP port 445) to the internet stops many of them, even before a patch exists. On a single Windows PC (run PowerShell as Administrator):

New-NetFirewallRule -DisplayName "Block outbound SMB to Internet" `
  -Direction Outbound -Protocol TCP -RemotePort 445 `
  -RemoteAddress Internet -Action Block

# check it
Get-NetFirewallRule -DisplayName "Block outbound SMB to Internet" | Format-List DisplayName, Enabled, Action

-RemoteAddress Internet keeps file shares on your local network working. In companies, apply the same rule at the perimeter firewall and consider restricting NTLM through Group Policy.

Windows Patch Tuesday: what else is critical

Different trackers count the release slightly differently (Tenable lists 1,093 CVEs with 63 critical; others list 1,094 with 64 critical). Whatever the count, these critical bugs deserve attention on servers:

• CVE-2026-118207, Exchange Server RCE (8.8): an authenticated attacker can send malformed input that runs code on the Exchange server. Microsoft rates exploitation "more likely".
• CVE-2026-118146, Active Directory Domain Services RCE (8.8): an authenticated attacker can abuse incorrect authorization to run code. Patch domain controllers promptly.
• CVE-2026-119952, Windows Schannel RCE (8.1): a flaw in Windows' TLS implementation that can be triggered without authentication.

Install and confirm Windows updates

On a PC: Settings > Windows Update > Check for updates, then restart. To confirm what's installed, use PowerShell:

# most recent updates installed on this machine
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID, InstalledOn

# when did Windows last install updates?
(New-Object -ComObject Microsoft.Update.AutoUpdate).Results

Running PHP websites? Don't forget PHP2Shell

October's PHP vulnerabilities remain the most urgent fix for anyone who runs a website. If your server's PHP version is lower than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, read our PHP2Shell guide and update today. Ubuntu servers can install security updates automatically: see how to turn on automatic security updates on Ubuntu.

Quick checklist

• [ ] Chrome and other browsers updated and relaunched
• [ ] Office / Outlook updated
• [ ] Windows updates installed and PC restarted
• [ ] Exchange and domain controllers patched (companies)
• [ ] Outbound SMB to the internet blocked
• [ ] PHP on web servers at a fixed version

Sources: Google Chrome Releases (9 Nov 2026), CISA Known Exploited Vulnerabilities catalog, Tenable and Trinetri Patch Tuesday analyses, SecurityOnline, PHP security advisories.