Microsoft Patches Plug 23 Security Holes

Summary: Microsoft released security updates addressing at least 23 distinct vulnerabilities in Windows and other software, including three critical patch bundles that let attackers compromise Windows PCs without user help. The critical updates include a cumulative Internet Explorer patch (MS13-059) covering every browser version on nearly all supported Windows versions, a browse-and-get-owned font flaw (MS13-060) affecting Windows XP and Server 2003, and Exchange flaws (MS13-061) stemming from Oracle's Outside In component.
What's compelling: Microsoft warns it is highly likely attackers will soon develop exploit code for the Internet Explorer flaws, and the IE patch addresses a vulnerability first demonstrated at the Pwn2Own contest in March 2013 - meaning proof-of-concept work is already public.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026