Windows 10 getting its own share of patches too

Jun 15, 2016 06:48 GMT  ·  By

It’s Patch Tuesday time, and Microsoft has released a total of 16 security updates to fix flaws in its software, including the Windows operating system, browsers such as Internet Explorer and Edge, Office productivity suite, and exchange server.

What’s important to note is that Adobe has also announced a Flash Player patch as it has discovered that flaws affecting the latest versions are already being exploited in the wild. The update, however, is not ready yet, so when Adobe releases it, Microsoft will start shipping it to its users via Windows Update as well.

There are 5 critical security updates in today’s rollout, and obviously, users and IT admins are strongly recommended to prioritize their install.

If you are still using Microsoft’s browsers, no matter if we’re talking about Edge in Windows 10 or Internet Explorer in any Windows version, the main focus should be on MS16-063 and MS16-068, which are cumulative updates for IE and Edge, respectively. Both are aimed at remote code execution flaws and patch issues that would otherwise allow an attacker to gain the same rights as the logged-in user.

Microsoft says that a successful exploit involves redirecting users to a specially compromised website, so make sure you don’t click on links coming from untrusted sources until you patch systems.

Windows Server admins, beware!

IT admins working with Windows Server should look after MS16-071, an update that’s supposed to fix a flaw in Microsoft’s DNS server that is rated as critical. Security experts warn that everyone should install this update as soon as possible on their servers because compromising a server could lead to exposing a bigger number of computers connected to it.

“Successful exploitation yields the attacker Remote Code Execution (RCE) on the server, which is extremely worrisome on such a mission critical service such as DNS. Organizations that run their DNS server on the same machine as their Active Directory server need to be doubly aware of the danger of this vulnerability,” Wolfgang Kandek, CTO of Qualys, said.

Just like all the other updates, everything is shipped via Windows Update regardless of your Windows version. Some require a system reboot, so IT admins should save work on all computers before starting deployment.