Zero-Days Rule November’s Patch Tuesday
Summary: Microsoft released eight patches fixing at least 19 vulnerabilities, three rated critical, including an Internet Explorer zero-day (MS13-088) already under active exploitation and an ActiveX flaw (MS13-090) used in targeted attacks, with exploit code for the ActiveX issue appearing on Pastebin the morning of release. Adobe separately patched at least two Flash Player flaws, bringing the player to v. 11.9.900.152, and fixed two ColdFusion vulnerabilities, one of which Hold Security's Alex Holden reported was used in an attack attempt against a ColdFusion version 8 resource, a claim Adobe disputes.
Key Takeaway: Rapid7's Ross Barrett called patching the ActiveX flaw priority #1 precisely because public exploit code turns targeted exploitation into broader attacks, and Microsoft's own patch deployment chart agrees. Meanwhile the batch shipped without an official fix for another zero-day under active exploitation, covered only by a stopgap Fix-It tool.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026