Photo by Amelia Holowaty Krales / The Verge
Microsoft has patched a Windows vulnerability that hackers are actively exploiting. If you own a system that uses Windows 7 and up, you’ll want to update your computer as soon as possible (via Bleeping Computer).
The security flaw, called Follina (CVE-2022-30190) by researchers, lets bad actors hijack users’ computers through programs like Microsoft Word. Security researchers have been aware of the threat since late May, but Microsoft reportedly dismissed their initial findings.
In an attack documented by security company Proofpoint, hackers associated with the Chinese government sent malicious Word documents to Tibetan recipients. When opened, these documents use the Follina exploit to take control of the Microsoft Support Diagnostic Tool (MSDT) to execute commands that could be used to install programs, create new user accounts, and access, delete, or change data stored on a computer. The exploit has also been used in phishing campaigns targeting American and European government agencies.
Microsoft’s original warning about the threat offered workarounds to protect against the threat, but this update (KB5014699 for Windows 10 and KB5014697 for Windows 11) should eliminate the need for that. “Microsoft strongly recommends that customers install the updates to be fully protected from the vulnerability,” Microsoft says. “Customers whose systems are configured to receive automatic updates do not need to take any further action.”