Exploit Published for New Internet Explorer Flaw
Hackers have released exploit code that can be used to compromise Windows PCs through a previously unknown security flaw present in all versions Internet Explorer, Microsoft warned today. — Dave Forstrom, director of trustworthy computing at Microsoft …
Context & Ripple Effects
The exploit lands on Christmas Eve 2010, but the shape of the problem is familiar: Microsoft has spent years managing flaws that surface faster than its monthly patch cycle. In August 2006 the company shipped a fix that itself opened users to attack, and in September 2009 it confirmed criminals were exploiting an unpatched IIS server bug before any update existed.
What distinguishes this disclosure is scope — Dave Forstrom's trustworthy computing team confirms the flaw spans every version of Internet Explorer, meaning no IE user on any supported Windows release has a configuration exemption. With exploit code public and no patch available, exposure is immediate and universal across Microsoft's browser installed base.
First-order effects
- Windows users running any version of Internet Explorer are immediately exposed: the exploit code is published and weaponized before Microsoft can ship a fix, leaving mitigation steps as the only defense until Patch Tuesday at the earliest.
- Microsoft's trustworthy computing group, fronted by Dave Forstrom, is forced into an incident-response posture over a holiday weekend — confirming the flaw publicly while racing to reverse-engineer and patch it.
Second-order effects
- Enterprises standardizing on IE face a forced choice between blocking or restricting the browser ahead of a fix and accepting drive-by compromise risk — a cost calculation that recurs every time an all-versions flaw goes unpatched.
- Every new all-versions IE zero-day hands rival browsers a switching argument at exactly the moment corporate IT reevaluates defaults, pressuring Microsoft's browser lock-in.
Third-order effects
- If the pattern holds — public exploits arriving during the gap between Patch Tuesdays — Microsoft's fixed monthly cadence becomes structurally inadequate for its most-targeted software, pushing toward more out-of-band emergency releases.
- A decade of recurring IE flaws spanning 2006's bad patch through 2009's IIS exploitation points toward browser choice being treated as a security decision rather than a default, eroding the assumption that Windows ships with a safe built-in browser.
The trend: Microsoft is locked in a recurring cycle where Internet Explorer's ubiquity makes it the primary exploit target, repeatedly forcing the company to respond to published attack code before a patch exists.