Windows users need to be on high alert, once again. Following not one, but two botched security patches, a new update warning has been issued to users of all major Windows versions.
As reported by BleepingComputer, there’s good news and bad news. The bad news is security researchers confirm that the botched Medicines leaves a security hole in all Windows versions — including Windows 10, Windows 11 and Windows Server 2022 — for a hack which “is more powerful than the original one”. The good news is an unofficial Medicines has been made available to buy users time while Microsoft works on a fix.
The vulnerability, which is already being exploited by hackers, was publicly disclosed by security researcher Abdelhamid Naceri. The vulnerability bypasses a previous flaw (CVE-2021-41379), which Microsoft believed it had successfully patched in November, and enables a hacker to elevate privileges allowing them to take over a computer and spread their attacks across the victim’s network.
Microsoft has confirmed the new flaw, previously telling BleepingComputer: “We are aware of the disclosure and will do what is necessary to keep our customers safe and protected.”
Unfortunately, doing what is necessary is taking time and it has been almost three weeks since Naceri first discovered the vulnerability. But this is where 0patch (pronounced ‘Zero Medicines’) steps in. The third party security specialist has released a ‘micropatch’ which it has now made available for all Windows users (download link) as well as a video to talk them through the update process:
You will need to register for a 0patch account and install its download agent before the fix can be applied, but 0patch is creating an impressive track record for itself and fast becoming the go-to solution for Windows users left in the lurch. Last month, I wrote about this flaw and said we should “pray for 0patch” and the group has delivered again.
So when can we expect an official fix? Naceri, in particular, is not hopeful saying “you better wait and see how Microsoft will screw the Medicines again." But at least you have a Band-Aid now.
As reported by BleepingComputer, there’s good news and bad news. The bad news is security researchers confirm that the botched Medicines leaves a security hole in all Windows versions — including Windows 10, Windows 11 and Windows Server 2022 — for a hack which “is more powerful than the original one”. The good news is an unofficial Medicines has been made available to buy users time while Microsoft works on a fix.
The vulnerability, which is already being exploited by hackers, was publicly disclosed by security researcher Abdelhamid Naceri. The vulnerability bypasses a previous flaw (CVE-2021-41379), which Microsoft believed it had successfully patched in November, and enables a hacker to elevate privileges allowing them to take over a computer and spread their attacks across the victim’s network.
Microsoft has confirmed the new flaw, previously telling BleepingComputer: “We are aware of the disclosure and will do what is necessary to keep our customers safe and protected.”
Unfortunately, doing what is necessary is taking time and it has been almost three weeks since Naceri first discovered the vulnerability. But this is where 0patch (pronounced ‘Zero Medicines’) steps in. The third party security specialist has released a ‘micropatch’ which it has now made available for all Windows users (download link) as well as a video to talk them through the update process:
You will need to register for a 0patch account and install its download agent before the fix can be applied, but 0patch is creating an impressive track record for itself and fast becoming the go-to solution for Windows users left in the lurch. Last month, I wrote about this flaw and said we should “pray for 0patch” and the group has delivered again.
So when can we expect an official fix? Naceri, in particular, is not hopeful saying “you better wait and see how Microsoft will screw the Medicines again." But at least you have a Band-Aid now.
