Microsoft: No More Pick-and-Choose Patching
Summary: Microsoft's October 2016 Patch Tuesday bundle fixed at least five zero-day vulnerabilities that attackers were already exploiting, in Internet Explorer, Edge, Microsoft Office, the GDI+ graphics component, and the Windows Internet Messaging component. The same release ended cafeteria-style patching: Windows 7 SP1 and 8.1 users can no longer pick individual updates, receiving instead a single Monthly Rollup for consumers or a security-only update for enterprises, so a broken patch can only be removed by uninstalling the entire bundle.
What's compelling: Five flaws were already under active exploitation before the fixes shipped, and with rollups an enterprise that hits one bad patch must pull the whole month's security content - including those zero-day fixes - to recover.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026