Get all your news in one place.
100's of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

Microsoft quietly patches LNK vulnerability that's been weaponized for years

Password recovery concept image showing man typing on a keyboard with an overlay imitating password recovery and data recovery principles.
  • Microsoft’s November 2025 Patch Tuesday fixed 63 flaws, including CVE-2025-9491 in Windows LNK files
  • The bug let attackers hide malicious commands in shortcut files, enabling RCE attacks
  • Exploited since 2017 by state-sponsored groups from China, Iran, North Korea, and Russia; severity rated 7.8/10

The November 2025 Patch Tuesday cumulative update fixed a vulnerability that hackers have been exploiting for years.

Sign up to read this article
Read news from 100's of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.