Cybersecurity news for Wednesday, November 11, 2026.
The stories were published on Tuesday, November 10, 2026 and Wednesday, November 11, 2026. Added on Wednesday, November 11, 2026.
Microsoft's November updates fix an Outlook flaw already used in attacks, The Hacker News and SecurityWeek report
Reported by The Hacker News, published Wednesday, November 11, 2026, and SecurityWeek, published Tuesday, November 10, 2026.
What happened
Both outlets report on Microsoft's November 2026 security updates. They give different totals. The Hacker News says the updates fix 1,259 flaws. SecurityWeek says they fix 1,094. We have not combined the two. Both say Microsoft knows one flaw in Outlook is already being used in attacks. SecurityWeek says Microsoft's notice gives no details of those attacks. The Hacker News says Microsoft has not named who is behind them. SecurityWeek says the flaw is a spoofing issue in which Outlook gives users no warning before a possibly dangerous action. We mean by spoofing something that pretends to be trustworthy.
SecurityWeek says Microsoft stated that the flaw cannot be triggered through the Preview Pane. SecurityWeek lists the affected products as Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024.
What the reports say about how it happened
Both reports say an attacker would send a specially made message file and get the person to open it. Both reports say opening the file can make Outlook contact a place the attacker controls, without the usual warning about outside content. SecurityWeek says Microsoft states this reveals the user's NTLMv2 hash (a piece of login information), which the attacker could use to act as that user. The Hacker News adds that the attack needs a network connection.
The Hacker News gives advice from security researchers on what to fix first, which we do not repeat.
Scammers use details on social media to target veterans, the Federal Trade Commission reports
Reported by the Federal Trade Commission (FTC), published Tuesday, November 10, 2026.
What happened
The FTC published a Veterans Day reminder about scams on social media. It says the details people share there can help scammers reach them. It names military history, promotion photos and tagged places as examples. It says some messages offer fake grants for veterans, and some claim to come from the U.S. Department of Veterans Affairs (VA). The FTC says: "The VA will never message you on social media." It also describes video ads that promise a sure way to beat the stock market.
What the article says about how it happened
The FTC says the grant messages send people to fake websites that claim to check whether they qualify. It says the aim is to collect personal information, such as Social Security numbers or VA website login details. For the ads, it says scammers use fake profiles and military terms. It also says: "Investments always come with risk."
The FTC advises using the privacy settings on each platform to put limits in place, so scammers have less to work with. It advises not letting someone you met on social media direct your investment decisions. It advises checking any VA benefit offer through the VA's own website. It also advises using the VA's Accreditation Search Tool to confirm that anyone helping with a benefits application is recognized by the VA.
The FTC says to report scams aimed at veterans at VSAFE.gov.
