Usually, I tell people to wait a few days before installing a major Windows update—just in case it breaks your printer or deletes your Bluetooth drivers.
This is not one of those times.
Microsoft has just rolled out emergency fixes for a cluster of security vulnerabilities in Windows and Office that are currently being “actively abused” by hackers. These aren’t theoretical risks found in a lab; they are zero-day exploits, meaning the bad guys found them before Microsoft could fix them, and they are using them right now.
The “One-Click” Nightmare
The scariest of the bunch is officially tracked as CVE-2026-21510. It’s a flaw in the Windows Shell—the core of your OS user interface.
Here is why it’s bad: It is a “one-click” attack.
You don’t need to download a shady .exe file and run it as an administrator to get infected. You just have to be tricked into clicking a malicious link or a shortcut file.
Normally, Windows SmartScreen would pop up and yell, “Hey, this is dangerous!” But this bug allows hackers to bypass SmartScreen entirely.
“There is user interaction here, as the client needs to click a link… Still, a one-click bug to gain code execution is a rarity.” — Dustin Childs, Security Expert
The Ghost of Internet Explorer
Another critical patch covers CVE-2026-21513. This one lives in the MSHTML engine.
“But Priya,” you say, “I haven’t used Internet Explorer since 2015.”
It doesn’t matter. The MSHTML engine is still buried deep inside modern versions of Windows to support backward compatibility for ancient apps. Hackers know this, and they are targeting it to plant malware on fully updated machines.
Google Sounded the Alarm
Microsoft credited researchers from Google’s Threat Intelligence Group for spotting these. Google confirmed that the Windows Shell bug is under “widespread, active exploitation,” warning that it can lead to silent malware installation, ransomware deployment, and intelligence theft.
What You Need To Do
Microsoft has released the patches. Details on how to exploit these bugs are now public, which means script kiddies everywhere are about to try their luck.
- Open Settings.
- Go to Windows Update.
- Click Check for Updates.
- Restart your computer.
Do it now. Your spreadsheet can wait.