Microsoft Patches 40 Security Holes
Summary: Microsoft issued 17 software updates fixing 40 security holes, including a critical Internet Explorer update covering at least seven vulnerabilities in versions 6, 7 and 8, three of which were publicly disclosed beforehand and at least one of which was already being actively exploited. McAfee counted 106 security bulletins and 266 patched vulnerabilities for Microsoft in 2010, both records, and the batch also fixed the Windows Task Scheduler flaw used by Stuxnet, which Symantec said at least two new threats were then exploiting.
What's compelling: The IE zero-day was first detailed on November 3 and was still being exploited when the patch arrived, and the Task Scheduler flaw gave a regular user a path to administrator rights - the same opening Stuxnet used and that two new threats had already picked up.
Read the original at Krebs on Security ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026