Cryptic Rumblings Ahead of First 2020 Patch Tuesday
Summary: Sources told KrebsOnSecurity that Microsoft planned to release a Jan. 14, 2020 Patch Tuesday update for an extraordinarily serious flaw in crypt32.dll, a cryptographic component present in all Windows versions since Windows NT 4.0, with early patches quietly shipped to branches of the U.S. military and other high-value customers under non-disclosure agreements. The NSA later confirmed it reported the bug, the first time Microsoft credited the agency for a flaw, and Microsoft released updates for CVE-2020-0601 affecting Windows 10 and Windows Server 2016, with no active exploitation seen yet.
Why it matters: A flaw in the module that handles certificate and cryptographic messaging could let attackers spoof a legitimate software company's digital signature so malware appears signed by a trusted vendor, and the NSA's own framing was that it makes trust vulnerable.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026