In a Zero-Day World, It’s Active Attacks that Matter
Summary: Krebs on Security reviewed vulnerabilities fixed by Google, Microsoft and Mozilla since January 2011 and found Internet Explorer was the only one of the three with critical, unpatched flaws demonstrably exploited by attackers before patches shipped. By Microsoft's own account there were at least six actively exploited IE zero-days in 18 months, leaving IE users under zero-day attack for at least 152 days, including at least 89 non-overlapping days of critical zero-days, while Google said it had never observed a Chrome zero-day in the wild against stable versions and Mozilla pointed to October 2010 as its last true Firefox zero-day.
Bottom line: Microsoft's 42-day delay patching CVE-2012-1889 was long enough for exploit code to be folded into the Blackhole exploit kit, one of the most widely used attack kits at the time - a reminder that the window between disclosure and weaponized, mass-distributed exploit is measured in weeks, not months.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026