Microsoft security patch release for CVE-2025-9491
Security Patch Release
Summary
Hide ▲
Show ▼
Microsoft's November 2025 updates quietly changed Windows LNK handling to mitigate CVE-2025-9491, a flaw used to hide malicious commands inside shortcut files. The update now reveals the full Target field in shortcut properties, making concealed command-line arguments easier to spot. It is a mitigation rather than a full fix, so the malicious command string still remains in the file.
Related Happenings
Microsoft April 2026 Patch Tuesday security update (165 CVEs)
Security Patch Release
First: 15.04.2026 00:22
Last: 15.04.2026 00:22
Sources 1
About this happening:
**Microsoft** shipped **April 2026 Patch Tuesday** updates covering **165 CVEs**, including an **actively exploited zero-day** and a **publicly disclosed** flaw, creating immediat...
Microsoft April 2026 Patch Tuesday security update (165 CVEs)
Security Patch ReleaseAbout this happening: **Microsoft** shipped **April 2026 Patch Tuesday** updates covering **165 CVEs**, including an **actively exploited zero-day** and a **publicly disclosed** flaw, creating immediat...
Microsoft March 2026 Patch Tuesday (83 CVEs)
Security Patch Release
First: 11.03.2026 03:08
Last: 11.03.2026 03:08
Sources 1
About this happening:
**Microsoft** released its **March 2026 Patch Tuesday** update with **83 CVEs** across its product range, reducing exposure to a broad set of flaws that includes issues Microsoft...
Microsoft March 2026 Patch Tuesday (83 CVEs)
Security Patch ReleaseAbout this happening: **Microsoft** released its **March 2026 Patch Tuesday** update with **83 CVEs** across its product range, reducing exposure to a broad set of flaws that includes issues Microsoft...
ClickFix Windows Terminal Lumma Stealer campaign
Campaign
First: 06.03.2026 08:44
Last: 06.03.2026 08:44
Sources 1
About this happening:
A **widespread ClickFix** campaign is abusing **Windows Terminal (wt.exe)** to run malicious commands and deploy **Lumma Stealer**, expanding the risk of credential theft and brow...
ClickFix Windows Terminal Lumma Stealer campaign
CampaignAbout this happening: A **widespread ClickFix** campaign is abusing **Windows Terminal (wt.exe)** to run malicious commands and deploy **Lumma Stealer**, expanding the risk of credential theft and brow...
Microsoft VS Code Live Preview fix in version 0.4.16
Security Patch Release
First: 19.02.2026 12:45
Last: 19.02.2026 12:45
Sources 1
About this happening:
Microsoft's **VS Code 0.4.16** quietly fixed a **Microsoft Live Preview** flaw that could expose **developer files** when the extension was running. The update closes one exploita...
Microsoft VS Code Live Preview fix in version 0.4.16
Security Patch ReleaseAbout this happening: Microsoft's **VS Code 0.4.16** quietly fixed a **Microsoft Live Preview** flaw that could expose **developer files** when the extension was running. The update closes one exploita...
Lnk-it-up open-source suite for generating and detecting malicious Windows LNK shortcuts
Security Tool/Service
First: 12.02.2026 23:01
Last: 12.02.2026 23:01
Sources 1
About this happening:
**lnk-it-up** is a newly released open-source suite for **Windows LNK shortcuts** that helps testers generate deceptive files and helps defenders spot shortcuts where **Explorer**...
Lnk-it-up open-source suite for generating and detecting malicious Windows LNK shortcuts
Security Tool/ServiceAbout this happening: **lnk-it-up** is a newly released open-source suite for **Windows LNK shortcuts** that helps testers generate deceptive files and helps defenders spot shortcuts where **Explorer**...
Timeline
-
03.12.2025 18:45 2 articles · 5mo ago
Initial report: Microsoft security patch release for CVE-2025-9491
Initial DisclosureInitial mitigation phase: Microsoft began changing **.lnk** handling in **November 2025** after **CVE-2025-9491** had already been abused in zero-day attacks. The change focuses on exposing the full **Target** field during inspection rather than removing the embedded command.
Show sources
- Microsoft "mitigates" Windows LNK flaw exploited as zero-day — www.bleepingcomputer.com — 03.12.2025 18:45
- Microsoft "mitigates" Windows LNK flaw exploited as zero-day — www.bleepingcomputer.com — 03.12.2025 18:45