Attackers Target Internet Explorer Zero-Day Flaw
Summary: FireEye reported that the Council on Foreign Relations website was compromised and rigged to exploit a previously undocumented flaw in Internet Explorer 8, using Adobe Flash to install malicious software on fully-patched PCs that browsed the site. Microsoft's Dustin Childs said the vulnerability appears to affect IE 6 through 8, while users of IE 9 and 10 are not impacted, and Microsoft later issued an advisory with a stopgap FixIt solution pending an official patch.
Why it matters: This is a watering hole attack: attackers compromised a legitimate site frequented by the policy community to reach specific organizations, the same pattern seen earlier in zero-day attacks on visitors to the National Democratic Institute, The Carter Center, and Radio Free Europe. A fully-patched IE8 was not enough, and the exploit bypassed DEP using Return Oriented Programming and ASLR via a Java or Office DLL loaded at a predictable location.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026