Microsoft to Issue Emergency Patch for Critical Windows Bug
Summary: Microsoft said it will release an out-of-band update on Monday for a critical, remotely exploitable flaw in all versions of Windows, in the way the OS processes .lnk shortcut files. The flaw was first exploited by the Stuxnet worm, which targeted Windows machines running Siemens WinCC SCADA software, and Microsoft's Christopher Budd confirmed an increase in exploit attempts in the days before the announcement.
Bottom line: The same .lnk flaw has already been adapted into mainstream malware such as Sality and Zeus, so the exposure is no longer confined to SCADA networks or the original targeted campaign. Symantec placed roughly 60 percent of infected systems in Iran, with Indonesia and India also hard-hit, and Microsoft's stopgap FixIt tool altered desktop icons enough to make programs hard to distinguish.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026