Zero-day flaw puts all Windows 10 and Windows 11 PCs at risk

Zero-day flaw puts all Windows 10 and Windows 11 PCs at adventure — what to practice

a moody photo of a person, presumably a hacker, typing on a keyboard

(Paradigm credit: Getty Images)

A nasty new security flaw lets hackers have over Windows x and Windows 11 machines — and there'due south no fix available however.

A working exploit for the flaw, which its creator calls "InstallerFileTakeOver," was posted on the Microsoft-owned software repository GitHub this past Lord's day (November. 21).

Because our workplace computers are locked down past our IT section, we haven't been able to try out InstallerFileTakeOver. But several security experts say it works simply fine and gives full system command to logged-in users who unremarkably shouldn't be able to install, delete or modify programs.

Yeah, this LPE indeed works fine on a fully-patched Windows 11 organization. https://t.co/7v0oXSZrnM moving picture.twitter.com/kvvISKabeGNovember 22, 2021

Come across more

"This vulnerability affects every version of Microsoft Windows, including fully patched Windows 11 and Server 2022," said researchers at Cisco Talos yesterday (Nov. 23). "Talos has already detected malware samples in the wild that are attempting to take advantage of this vulnerability."

Can confirm this works, local priv esc. Tested on Windows x 20H2 and Windows 11.The prior patch MS issued didn't fix the issue properly. https://t.co/OEdmtlMZvYNovember 22, 2021

Encounter more

Unfortunately, there's no cinch mode to protect your PC just however, every bit the exploit'due south creator, Moroccan researcher Abdelhamid Naceri, explained in his GitHub post.

"The best workaround available at the fourth dimension of writing this is to wait Microsoft to release a security patch, due to the complexity of this vulnerability," wrote Naceri. "Whatever attempt to patch the binary direct will intermission Windows Installer," the Windows ten and Windows 11 program that updates Microsoft software.

The all-time way to defend yourself is to install and run some of the best Windows antivirus software, free or paid. Don't open up files that randomly come up to you from websites, electronic mail messages, social media or instant letters. And go along a close eye on who has access to your computer.

There's some defense in the fact that the attack has to start with a user who's already logged into the organisation. Only the attacker doesn't have to exist a human — malware that fabricated it onto the machine by other means could just as easily exploit this flaw.

Paul Wagenseil is a senior editor at Tom'due south Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He'south been rooting around in the data-security infinite for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom'southward Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random Boob tube news spots and even moderated a panel discussion at the CEDIA habitation-engineering science conference. You lot can follow his rants on Twitter at @snd_wagenseil.