
- Microsoft’s November 2025 Patch Tuesday fixed 63 flaws, including CVE-2025-9491 in Windows LNK files
- The bug let attackers hide malicious commands in shortcut files, enabling RCE attacks
- Exploited since 2017 by state-sponsored groups from China, Iran, North Korea, and Russia; severity rated 7.8/10
The November 2025 Patch Tuesday cumulative update fixed a vulnerability that hackers have been exploiting for years.