Microsoft says hackers are exploiting critical zero-day bugs to target Windows and Office users

Microsoft released patches for several actively exploited zero-day vulnerabilities in Windows and Office — including CVE-2026-21510 (Windows Shell) and CVE-2026-21513 (MSHTML) — that enable one-click remote code execution, SmartScreen bypass, and silent high-privilege malware installation; Google and independent reporters confirmed widespread active exploitation and risk of subsequent ransomware or intelligence collection.