Loading story…
Microsoft released emergency security updates for severe remote code execution flaws that affected both supported and legacy Windows systems, including unusual patches for end-of-life platforms such as Windows XP, Windows Server 2003, and Windows Vista. One of the most serious cases was CVE-2019-0708 (BlueKeep), a pre-authentication vulnerability in Remote Desktop Services that Microsoft and security researchers warned was wormable, meaning malware could spread between vulnerable machines without user interaction. Microsoft directed customers on unsupported systems to obtain out-of-band fixes through the Microsoft Update Catalog, while researchers urged organizations to patch exposed RDP services immediately.
Microsoft had taken a similar extraordinary step earlier for a critical Internet Explorer zero-day affecting IE 6 through IE 11, issuing an emergency update even for retired Windows XP after active exploitation expanded in the wild. Reporting at the time said attackers were using malicious websites to trigger remote code execution and broadened targeting from defense and financial firms to government and energy organizations. Later coverage of BlueKeep warned that public exploit explanations increased the risk of destructive attacks, reinforcing concerns that unpatched legacy Windows systems remained a high-value entry point for widespread compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
An explainer describing how to exploit the wormable BlueKeep vulnerability was posted online on GitHub. Reporting said the publication increased concern that destructive or widespread exploitation could follow.
McAfee released a blog post explaining the BlueKeep RDP flaw, emphasizing its wormable nature and the need for urgent patching. The write-up helped publicize technical understanding of CVE-2019-0708 after Microsoft's advisory.
Microsoft published customer guidance for CVE-2019-0708, a critical wormable Remote Desktop Services remote code execution vulnerability. It also released out-of-band updates for unsupported platforms including Windows XP, Windows Server 2003, and Windows Vista, urging organizations to patch immediately.
An optional update for the Visual Studio 2010 Tools for Office Runtime was pulled within about two hours of release after reports that it caused update hangs on some systems. The withdrawal occurred alongside the February 2015 Patch Tuesday rollout.
Microsoft released nine Patch Tuesday bulletins, including three rated Critical, covering vulnerabilities in Internet Explorer, Windows, Office, and other components. Key fixes included MS15-009 for Internet Explorer, MS15-010 for Windows kernel TrueType font handling, and MS15-011 for a domain-related Windows flaw triggered when connecting to an untrusted network.
Researcher Jeff Schmidt, then working for ICANN, reported a Windows vulnerability later tracked as MS15-011 to Microsoft. The flaw ultimately required substantial operating system re-engineering to fix.
FireEye said exploitation of the Internet Explorer zero-day had expanded beyond IE 9–11 on Windows 7 and 8 to include Windows XP users running IE 8. It also reported that multiple new threat actors were using the exploit and broadening targeting from defense and finance to government and energy organizations.
Microsoft issued an out-of-band security update for Internet Explorer 6 through 11 on supported Windows versions and also for retired Windows XP. The patch addressed a critical remote code execution flaw that was being actively exploited via malicious websites.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
support.microsoft.com
Open sourceweb.archive.org
Open sourcemcafee.com
Open sourcemsrc-blog.microsoft.com
Open sourcezdnet.com
Open sourcearstechnica.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft issued urgent warnings over **BlueKeep** (`CVE-2019-0708`), a pre-authentication remote code execution flaw in Windows Remote Desktop Services that could be used in a **wormable** attack resembling WannaCry. The company released fixes for supported systems and took the unusual step of patching unsupported platforms including **Windows XP**, **Vista**, and **Server 2003**, warning that nearly **1 million** internet-facing hosts exposing RDP on port `3389` remained vulnerable. Security researchers and vendors reported that the flaw was exploitable, with proof-of-concept and denial-of-service code already circulating, while affected systems included Windows 7, Server 2008, and Server 2008 R2; newer platforms such as Windows 8, Windows 10, and later server versions were not impacted. Researchers and government agencies subsequently intensified calls to patch as exploit development accelerated, and Microsoft later confirmed **in-the-wild exploitation** of BlueKeep. Its investigation tied observed attacks to an opportunistic **cryptomining campaign** that scanned for exposed RDP services, used an unstable Metasploit-based BlueKeep exploit, launched staged PowerShell payloads, and installed persistent coin-mining malware on compromised machines. Microsoft said the activity caused RDP-related crashes seen in honeypots and telemetry across multiple countries, and warned that although the initial payload was a miner, the same vulnerability could be repurposed for far more destructive malware if organizations failed to patch or restrict direct RDP exposure.
Aug 8, 2026
Microsoft released security updates addressing **79 vulnerabilities** across its product portfolio, including **19 remote code execution** flaws and several issues already under active exploitation. The most severe bug, **`CVE-2024-43491`**, is a **Windows Update** use-after-free vulnerability with a **CVSS 9.8** rating that can allow **unauthenticated remote code execution**. Critical vulnerabilities were also reported in **Microsoft SharePoint Server**, **Azure Web Apps**, **Azure Stack Hub**, and **Windows Network Address Translation**, expanding the risk beyond endpoint systems to server and cloud-connected environments. Microsoft and third-party reporting said attackers were already exploiting **`CVE-2024-38014`** in **Windows Installer**, **`CVE-2024-38217`** in **Mark of the Web**, **`CVE-2024-38226`** in **Microsoft Publisher**, and **`CVE-2024-43491`** in **Windows Update**. The updates were published through Microsoft’s Security Update Guide and release notes, including related Mariner release information, and organizations were urged to prioritize deployment because the exploited flaws span privilege escalation and remote code execution paths across multiple supported Windows versions and Microsoft products.
Jul 24, 2026
Microsoft released **MS14-080**, a cumulative security update for **Internet Explorer** that addressed 14 privately reported vulnerabilities across **IE 6 through IE 11**. The most severe flaws could allow **remote code execution** if a user visited a specially crafted webpage, with client systems generally rated **Critical** and affected Windows Server configurations rated **Moderate**. The bulletin said the update corrected multiple memory corruption issues, two **XSS filter bypass** flaws, an **ASLR bypass**, and the **VBScript** memory corruption bug tracked as `CVE-2014-6363`. Microsoft also published **MS14-084**, another **Critical** security bulletin, alongside later revisions to the Internet Explorer advisory that required additional updates in some environments, including **3029449** for **IE10** on Windows 8, Windows Server 2012, and Windows RT, and **3038314** for **IE11** on Windows 7 and Windows Server 2008 R2. The combined advisories highlighted urgent patching needs for Microsoft platforms because successful exploitation could let attackers run arbitrary code through user interaction with malicious content.
Aug 15, 2026