Microsoft confirms plan to release out-of-band IE update
I just spoke with George Stathakopoulos, General Manager of Trustworthy Computing Security at Microsoft, regarding the ongoing security issue affecting Internet Explorer. (For background, see my earlier post, It's time to stop using IE6.)
Context & Ripple Effects
Microsoft has form here. Its December 2008 emergency bulletin MS08-078 was an out-of-band Internet Explorer patch, and before that a 2007 security update famously crippled IE for users who installed it — a track record that makes both the flaw and the fix politically charged inside Redmond.
What changed today: George Stathakopoulos, GM of Trustworthy Computing Security, confirmed to Ed Bott that Microsoft will ship another unscheduled IE update rather than wait for February's Patch Tuesday. It lands alongside Bott's own public argument, published the same day, that it is time to stop using IE6 altogether — analyst pressure and vendor response converging on the same week.
First-order effects
- Windows users and enterprise IT admins face an unscheduled deployment: a critical IE fix arrives outside the monthly Patch Tuesday rhythm, forcing off-cycle testing and rollout for organizations that standardize on Microsoft's calendar.
- For Microsoft, this is the second out-of-band IE update in roughly thirteen months, putting Trustworthy Computing Security back into reactive mode on a product line it had been defending against exactly this kind of exposure.
Second-order effects
- Enterprises still standardized on IE6 now have both a confirmed vulnerability and a credible analyst case for migration, accelerating internal debates over upgrading to newer IE versions or moving off IE entirely.
- Browser vendors competing with IE gain an opening: every emergency Microsoft patch reopens the security comparison at the moment customers decide which default browser to lock down.
Third-order effects
- If actively exploited IE flaws keep forcing unscheduled releases, out-of-band patching stops being exceptional and becomes an expected tool — eroding the predictable monthly cadence enterprises plan around.
- The pattern points toward structural shrinkage of the legacy IE install base: each crisis raises the cost of keeping IE6 alive, pushing the long tail of corporate holdouts toward newer browsers or non-Microsoft defaults.
The trend: Internet Explorer's security model is shifting from scheduled monthly patching toward ad hoc emergency releases, and each one accelerates the retirement of Microsoft's legacy browser versions.