Microsoft’s Patch Trouble

This article <https://arstechnica.com/information-technology/2022/06/botched-and-silent-patches-from-microsoft-put-customers-at-risk-critics-say/> relates Microsoft’s ongoing troubles coming up with proper patches for security-related issues in its systems. For example, there was a vulnerability in Azure that took over three months and three different patches before the problem could be considered fixed. (The article describes the time interval as “five months”, but to be fair, the final patch came out just over three months after the initial notification.) Then there is the “Follina” vulnerability, which lets an attacker execute code via Microsoft Office, even if you have macro autoexecution disabled. This was finally patched earlier this week -- over seven weeks after it had been seen being actively exploited in the wild. Microsoft’s response has a sentence beginning “We are deeply committed...”. I think this PR usage of the word “committed” should be on a bingo card for content-free buzzwords.
participants (1)
-
Lawrence D'Oliveiro