Microsoft Warns of Attacks on Zero-Day IE Bug
Summary: Microsoft warned Internet Explorer users that attackers are exploiting a previously unknown browser flaw to install malicious software, and urged users to upgrade to IE8, which includes Data Execution Prevention technology that makes the vulnerability harder to exploit. Microsoft said the exploit code was found on a single Web site that is no longer online, that it is working on a security update, and that the flaw does not meet the criteria for an out-of-band release.
What you should know: Symantec's log analysis of the exploited server showed the malware author had targeted organizations across multiple industries and countries, with very few users actually reaching the payload file - meaning the attacker picked specific victims and used a private exploit rather than casting a wide net.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026