As a zero-day security vulnerability posing significant risk to users is confirmed as under active exploitation—the DHS and Microsoft have urged millions to update now.

Microsoft this month released patches for Windows, Office and Edge — but none for Microsoft Exchange Server or SQL server.

The flaw—a "Common Log File System Driver Elevation of Privilege Vulnerability" named CVE-2024-49138—could give an attacker system privileges. This means they could gain access to your PC and compromise it at a level that's higher than admin privileges. The bug is a heap -based buffer overflow bug, meaning it's tied to a memory issue.

The confusion around Microsoft updates continues. Just as it releases the last Patch Tuesday of 2024, with a new zero-day amongst 71 vulnerabilities, it also warns 400 million users they risk losing access to future security fixes if they update their PCs.

Microsoft’s minimum requirements for Windows 11 cover several hardware components, including having enough RAM and a powerful enough microprocessor. But the most contentious issue is whether a PC contains or supports a Trusted Platform Module (TPM), specifically version 2.0, released in 2014.

Yesterday was the last Patch Tuesday of 2024, and with it Microsoft has provided a number of security updates, eliminating 71 security vulnerabilities across various Microsoft apps and services. Microsoft categorizes 16 of these vulnerabilities as “critical” and classifies all but one of the remaining issues as “high risk.

Microsoft updated its support page to warn users not to run Windows 11 on an unsupported PC, but the company also has official instructions on installing the operating system on devices that don't meet minimum requirements. Generally, that means PCs with a TPM 2.0 chip — a security chip required for Windows 11.