GoKawiil
Tech News
Microsoft's November security update addressed 1,093 vulnerabilities, 63 of them rated critical, marking its second consecutive month with a four-digit CVE count. Among them is CVE-2026-124194, a moderate-severity Outlook spoofing flaw that Microsoft has confirmed is already being exploited, which can expose a victim's NTLMv2 hash via a malicious Office file.
Microsoft released updates addressing 1,093 security flaws across Windows and supported software, 63 of them rated critical. One flaw, CVE-2026-124194, a spoofing bug affecting Outlook and Microsoft 365 Apps, is already being actively exploited. The release brings Microsoft's total patches issued this year to over 5,100, alongside security updates this week from Apple, Adobe, Google and Mozilla.
Several Canadian regions, including parts of British Columbia, Alberta and Manitoba, stopped observing daylight saving changes on November 1, locking into fixed UTC offsets. Microsoft has confirmed that Outlook, Power Automate, Fabric and SharePoint On-Prem have not fully adapted, producing incorrect meeting times and requiring manual fixes from users and administrators.
After certain Canadian provinces stopped observing daylight-saving time changes on November 1, Microsoft confirmed widespread time-zone bugs across Outlook, Power Automate, Fabric, SharePoint and Power Pages. Fixes range from manual calendar updates in Outlook to workarounds that have users select unrelated time zones like Saskatchewan, Arizona or Bogota in Power Automate and Fabric, with some permanent fixes not expected until mid-November or December.
Microsoft has patched an issue in the classic Outlook desktop client that caused Copilot Chat and Copilot buttons to disappear from the navigation pane and ribbon for some licensed users. The company traced the problem to Outlook failing to retrieve certain account information from users' profiles, and said the fix addresses that root cause. This marks the second time Microsoft has fixed the bug after it resurfaced following recent updates despite an earlier June patch.
Security firm Sublime found that malicious calendar invites sent via email, known as ICS phishing, have surged dramatically, rising 282% in June, 338% in July, and 1,216% in August, with a projected 2,852% jump in September. These fake invites exploit a default feature in Outlook, Gmail, and Apple Mail that auto-adds ICS files to a user's calendar before they accept or decline them.
OpenAI reported elevated errors and latency on ChatGPT Work, its enterprise AI agent, for about three hours on Monday, while Microsoft separately confirmed degraded functionality across Exchange Online. Downdetector logged over 1,100 reports for OpenAI products and nearly 4,600 for Microsoft Outlook around 2:24 p.m. ET, though the companies gave no indication the two incidents were related.
Microsoft confirmed a widespread outage of Exchange Online on Monday, causing Outlook users to experience delayed or failed emails, authentication errors, and search failures. The company traced the problem to an authentication component and began testing a fix on part of its infrastructure before a broader rollout. Downdetector logged over 5,000 user reports by 2 PM ET, with complaints also flooding social media.