Outlook Zero-Day, Railway’s $740,000 AI Bill, and More
Three stories today have the same practical lesson hiding underneath them: software can quietly become a spending authority, an identity credential, or a privacy promise. That means the controls around it have to work in the real world, not merely look reassuring in a dashboard.
Outlook zero-day can expose Windows sign-in material
Microsoft has patched an Outlook zero-day that attackers were already exploiting before the fix arrived. The flaw, CVE-2026-124194, affects Microsoft 365 Apps for Enterprise plus Office LTSC 2021 and 2024. This is the item to prioritize from November’s Office updates.
The mechanism matters. An attacker has to persuade someone to open a specially crafted Outlook message file. Once opened, Outlook can connect to a network location controlled by the attacker without showing its normal warning. That connection may disclose the user’s NTLMv2 hash, a cryptographic response Windows uses during authentication.
That hash isn’t the user’s plain-text password, and the preview pane alone isn’t enough to trigger this bug. Those are useful qualifications, but not reasons to shrug. Depending on the network and account protections, stolen authentication material can sometimes be cracked, relayed, or reused in a follow-on attack. Microsoft rates the flaw only moderate, with a CVSS score of 6.5. Real exploitation is the more important number here.
CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave federal agencies a November 24 deadline. Everyone else should treat that as useful risk information, not as permission to wait until the 24th. Update Microsoft 365 Apps or install the current Office LTSC security release, then verify the update reached managed devices. Blocking outbound SMB and NTLM authentication to the public internet can reduce this class of exposure, but it doesn’t replace the patch.
For perpetual-license installations, Office LTSC 2021 needs build 16.0.14334.21048 or later, and Office LTSC 2024 needs 16.0.17932.21140 or later. Microsoft 365 Apps follows its normal update channels, which is exactly why administrators should check version reporting rather than assume the word “automatic” finished the job. If your organization has delayed Office updates for compatibility testing, this is the kind of exploited flaw that should move to the front of that queue.
Business IT goes well beyond the website
Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.
Railway’s breach turned stolen AI keys into a $740,000 bill
Cloud development platform Railway has published its final report on an October security incident. Attackers escaped the isolation around Railway’s build infrastructure, obtained an internal credential and source code, then abused a second, improperly configured trust relationship. Railway says the attackers could decrypt environment variables for at most about 100,000 workspaces. That is an upper bound on potential exposure, not a count of confirmed victims.
The attackers appeared especially interested in AI service credentials. Railway estimates those stolen keys generated about $740,000 in unauthorized usage. The company says it will cover charges that providers don’t refund, and it found no evidence that customer Git repositories or databases were downloaded.
Here’s what shouldn’t get lost in the breach mechanics: an API key isn’t just a secret. It can be a credit card with no cashier watching. Encryption at rest protects a key from someone who merely steals the storage. It does much less when an attacker compromises the trusted system that is allowed to decrypt the key. That distinction also matters in the secret-file problem we covered last week.
Railway told customers whose secrets predated October 21 to rotate them and review access logs. If that’s your business, finish that work. More broadly, give production keys the narrowest scope available, separate projects where practical, and turn on provider-side spending alerts or limits. Rotation helps after exposure. A budget control limits how expensive the exposure can become.
One more uncomfortable detail is worth keeping: Railway describes a 26-hour fight in which the attackers adapted while defenders worked. That is what automated, tool-assisted intrusion looks like in practice. Faster attackers don’t make fundamentals obsolete. They make preplanned key revocation, useful logs, and clear authority to cut off access more valuable, because improvising those decisions during the incident burns the time you don’t have.
Turning on AI is the easy part
Deciding what an AI tool should be allowed to see, who should use it, what work it should perform, and what happens when it gets something wrong is the more interesting problem. Raymond Tec helps businesses connect and automate the tools they actually use without treating every new feature like a button that obviously needs to be switched on.
FedEx’s privacy fine is a warning about controls that don’t control
California’s privacy regulator has ordered FedEx to pay nearly $3 million and change its practices after finding that the company’s website privacy controls didn’t consistently match what the site actually did. The decision says FedEx shared device or user identifiers with Meta, LinkedIn, Google, and Adobe for targeted advertising. It says shipping information wasn’t included.
The regulator also found that FedEx’s privacy policy said it didn’t sell or share personal information, that some advertising data continued after a user switched off cookie categories, and that the site failed to honor Global Privacy Control signals. GPC is a browser or extension signal that tells websites the user wants to opt out of sale or sharing. It isn’t magic, but covered businesses have to recognize it.
This is where a cookie banner stops being a design project and becomes an engineering and operations problem. The question isn’t whether the toggle moved. It’s whether every relevant tag, pixel, and server-side connection changed behavior after it moved. California ordered FedEx to maintain inventories and conduct quarterly testing. Smaller businesses may face different legal thresholds, but the technical lesson scales down perfectly: document what runs, test consent and GPC behavior, and make the privacy notice describe the system you actually operate. A polished banner that keeps sending the same data is theater with rounded corners.
The order also rejects a convenient bit of wishful thinking: a visitor doesn’t stop being a consumer merely because the browsing happens for work. If a company website receives identifiable California traffic, “we’re business-to-business” isn’t a substitute for checking which rules apply. No one needs to panic over every analytics request today. Website owners do need an accurate map of their data flows and someone responsible for retesting them after plugins, tags, and advertising tools change.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
- Microsoft Security Response Center: CVE-2026-124194
- CISA Known Exploited Vulnerabilities Catalog
- JPCERT/CC: Microsoft Releases November 2026 Security Updates
- Railway: October Security Incident Final Report
- California Privacy Protection Agency: FedEx enforcement announcement
- California Privacy Protection Agency: FedEx final decision
Photo by Andrea Piacquadio on Pexels.
