Email

Opening a crafted message file makes Outlook skip the external-content warning and leak NTLMv2 hashes; zero-day CVE-2026-124194 exploited and added to KEV

Microsoft’s November Patch Tuesday fixes Outlook spoofing flaw CVE-2026-124194: if a user opens a crafted message file, Outlook connects to an attacker-controlled location without the usual external-content warning and leaks an NTLMv2 hash that can be used to impersonate the user .

ESET said on November 10 that it found a previously undocumented modular .

The Roundcube team released Webmail security updates 1.

Barracuda updated its advisory on November 9 to confirm that the authorization bypass CVE-2026-116606 and the command injection CVE-2026-111560 in Email Security Gateway have been exploited against a small number of organizations; chained, they give root on the device when the attacker can reach the admin interface .

Security firm Todyl says that since Nov 1 an attacker has been using stolen, still-valid credentials to sign in to MSPs' Microsoft 365 and Azure environments as their own applications, targeting about 45 app registrations at roughly 18 organizations with more than 33 authenticating successfully .

ESET researchers exposed a Russia-aligned threat actor they named Gorbag, active since at least February 2025 and focused exclusively on Ukrainian targets, especially law enforcement and justice entities, local administrations near the front line, the defense sector and a major transportation hub for foreign military aid .

DreamHost says it discovered on October 23 that an unauthorized third party had accessed the server running its web-based File Manager at files.

PayCloud Holdings subsidiary Arara said its email delivery service Arara Message suffered unauthorized access; it first disclosed the incident on Oct 29, and its Nov 6 third report put the deduplicated number of taken (or possibly taken) email addresses at 81,329,467 .

Openwave Messaging says Webtop Media Transcoder before 1.

According to The Daily Star, Shwapno parent company ACI Logistics filed a police report stating that computers at its headquarters were locked by ransomware on August 19, 2025 .

According to Security NEXT, on December 10, 2025, the Nara Prefectural Welfare Center for the Visually Impaired misdirected an email when contacting volunteer group members .

According to Security NEXT, Keio University detected anomalous communications originating from a spam quarantine server at its Shonan Fujisawa Campus in late November 2025 .

According to Security NEXT, Kanagawa Prefecture announced that Kizuki, a contractor for its support program for freelance workers with disabilities, sent a misaddressed email on December 3, 2025 .

According to Security NEXT, on December 12, 2025, the Tokyo Metropolitan Government sent a webinar notification via its staff recruitment examinee portal to 9,086 applicants .

According to The Jerusalem Post, Shamir Medical Center suffered a cyberattack involving hospital email correspondence that leaked emails containing patient information .

According to New Zealand public broadcaster RNZ, the Wellington Cable Car website was compromised .

According to Prothom Alo, staff email accounts at Bangladesh's Agrani Bank were compromised in an incident involving bank-related documents, while the bank denied that its core banking systems had been hacked .

Poland's national computer security incident response team, CERT.

The City of Hamilton in Ontario, Canada published cybersecurity incident updates stating that municipal IT systems had been hit by a cyberattack .

In early 2024, Microsoft published incident response guidance regarding activity by threat actor Midnight Blizzard .