Massive Microsoft Patch Tuesday updates have become the norm and October may actually have broken records, fixing over 1,400 vulnerabilities in Windows. This comes just a month after the company released patches for more than 1,000 flaws, and then had to send out an emergency patch to fix what those updates broke.

This week, Microsoft shipped patches that covered a mind-boggling 1,413 flaws, including one that the company said was actively being exploited by hackers in the wild before the patch.

Those patches cover 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server and 22 in SQL Server. 670 of the patches are related to privilege escalation vulnerabilities. And 70 are rated as "Critical" in severity.

Microsoft credited Riku Bamba and Yuya Chudo of Fujitsu Limited and Benoit Sevens, who used Anthropic's Claude, with discovering the 96951 flaw which was exploited in the wild.

"In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability," the company explained. "In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker's site or send a malicious attachment."

It's not clear how this flaw is being exploited or by whom in the real world.

Source link