For everyone: Windows and Office. Microsoft's November updates fix a record number of flaws, including an Outlook zero-day already being exploited. Go to Settings, Windows Update, and check that updates are installed. If a restart is requested, do not postpone it again and again: most fixes take effect only after a restart. If you use Outlook through Office, make sure Office updates too.
For everyone: the browser. Google fixed the eighth Chrome zero-day exploited in attacks this year. Chrome updates itself, but only after you close and reopen it. In the menu, Help then About Google Chrome, you can check the version and trigger the update. Chrome-based browsers such as Edge, Brave and Opera need to get the fix separately, so check them too.
For IT staff: VPNs and servers. In Ivanti Connect Secure, two flaws chained in zero-day attacks since early October were fixed early this month and added to CISA's exploited vulnerabilities list. In OpenSSH, the flaw dubbed SSHole allows, under certain conditions, password-free login to servers based on Alpine Linux, and attackers are already trying to exploit it. In Xen Orchestra, a virtualization management tool, a critical authentication bypass is being actively exploited.
How to prioritize? The simple rule: a flaw already being exploited comes before any 'critical' flaw not yet exploited. After that, anything exposed to the internet: VPN servers, management interfaces, mail servers. Only then the rest. CISA's Known Exploited Vulnerabilities (KEV) list is a good, up-to-date source on what is really urgent.
One more tip: if you do not have time to check every update, turn on automatic updates everywhere you can, on your phone, computer, home router and apps. The risk that an update breaks something exists, but in a week like this, the risk of not updating is far greater.
