Russian APT weaponized a Microsoft Office zero-day within 24 hours — fintech was in the crosshairs

Microsoft shipped an emergency out-of-band patch for CVE-2026-21509 on January 26, 2026. APT28 exploited it the next day against government institutions and financial-sector targets. The patch-to-exploit window just collapsed.