Microsoft Fixes Stuxnet Bug, Again
Summary: Microsoft's March 2015 Patch Tuesday shipped 14 update bundles covering at least 43 vulnerabilities in Internet Explorer, Exchange, Office and other components, five of them rated critical. Among them is MS15-020, which fixes the same flaw Microsoft patched in August 2010 - a patch that did not fully work, leaving Windows users exposed since; that flaw was one of four zero-days used in Stuxnet.
Bottom line: A patch Microsoft shipped in 2010 to close the Stuxnet zero-day missed the mark, and the exposure stood for roughly five years - a reminder that 'patched' and 'fixed' are not the same claim, and that verifying remediation is its own control.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026