Zero-Day Exploit Published for IE8
Summary: Microsoft issued a May 3 advisory confirming a vulnerability in Internet Explorer 8 that is being actively exploited, affecting all IE8 copies on Windows XP, Vista and Windows 7 while IE6, 7, 9 and 10 are unaffected. A working exploit module was published to the Metasploit Framework, and the U.S. Department of Labor website was compromised in a watering hole attack that CrowdStrike said used the control server microsoftupdate.ns1.name and drew visitors from 37 countries.
Why it matters: AlienVault reported the same exploit on at least nine other hacked sites, and a public Metasploit module means the code is available to anyone who wants to fold it into a commercial crimeware kit before Microsoft's patch ships.
Read the original at Krebs on Security ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026