Security News

In October, a threat actor attempted to sell 23andMe customer data and, after failing to do so, leaked the data for 1 million Ashkenazi Jews and 4.1 million people living in the United Kingdom. 23andMe told BleepingComputer that the data was obtained through credential stuffing attacks to breach customer accounts.

Microsoft's Extended Security Updates program doesn't replace all of those options; ESUs just provide the monthly security updates from Windows Update and only cover what Microsoft classifies as critical or important vulnerabilities, which means no fixes for security issues you can mitigate without Microsoft making changes to Windows. What's different this time is that individuals will be able to buy the annual ESU subscription for their Windows 10 PCs. How can I get Extended Security Updates for Windows 10?

Microsoft will not abandon Windows 10 users to an insecure fate once it reaches end of support on October 14, 2025: both enterprises and individual consumers will be able receive Extended Security Updates, but will have to pay for them. "The ESU program enables PCs to continue to receive critical and important security updates through an annual subscription service after support ends. To be eligible to install updates from the ESU program, devices must be running Windows 10, version 22H2," Microsoft says.

Microsoft says that all Windows 10 customers will be able to pay for three extra years of security updates through the company's Extended Security Updates program after the end of support date. The upcoming Windows 10 22H2 version is the final Windows release, with all editions to continue to receive monthly security updates until the EOS date.

Microsoft has released the KB5032288 November 2023 Windows 11 preview update with improvements for the Copilot AI assistant and almost a dozen bug fixes. Windows Copilot started rolling out to Windows 11 22H2 devices in September and now is enabled by default on systems running Windows 11 23H2. After installing the KB5032288 preview update, the company says the AI-powered digital assistant will be available across multiple displays and will also show up as a thumbnail preview in the Alt+Tab dialog.

Google announced today that the December 2023 Android security updates tackle 85 vulnerabilities, including a critical severity zero-click remote code execution bug. "The most severe of these issues is a critical security vulnerability in the System component that could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation," the advisory explains.

Apple recommends users update to iOS 17.1.2, iPadOS 17.1.2 and macOS 14.1.2. Apple has patched two zero-day vulnerabilities affecting iOS, iPadOS and macOS; users are advised to update to iOS 17.1.2, iPadOS 17.1.2 and macOS 14.1.2.

Microsoft has started rolling out its Copilot AI assistant to Windows 10 with the KB5032278 November 2023 non-security preview update for systems running Windows 10, version 22H2. Two weeks ago, the company introduced Copilot to Windows 10 Insiders with eligible non-managed systems running Windows 10 22H2 Home and Pro editions. The AI assistant was first introduced in September, initially available on Windows 11 22H2 devices, and now enabled by default on Windows 11 23H2 devices.

Zyxel has patched six vulnerabilities affecting its network attached storage devices, including several command injection flaws that can be easily exploited by unauthenticated attackers. One of the six plugged security holes is an improper authentication vulnerability in the devices' authentication module, and may allow unauthenticated attackers to grab system information by sending a specially crafted URL to a vulnerable device.

Google has rolled out six Chrome security fixes including one emergency patch for a bug for which exploit code is already out there. Google doesn't provide a whole lot of detail about the bug, nor any details about who may be exploiting it and to what nefarious end.