Microsoft patch numbers hit record high

The number of critical flaws in Microsoft software has hit a record high, offering a prime opportunity for hackers to exploit the backlog of unprotected vulnerabilities, according to security experts.

So far this year, the software giant has already addressed more critical vulnerabilities than in 2004 and 2005 combined, according to security specialist McAfee.

This news follows Microsoft's monthly security patch update, issued yesterday, which highlighted nine 'critical' and three 'important' browser, Windows and Office-related flaws that allow remote code execution.

"With over 120 new vulnerabilities across all platforms and applications reported last just last week, a rate of 6,000 new vulnerabilities per year!), clearly the rate of vulnerability discovery is still outpacing the number of patches being released," said Alan Bentley, managing director, EMEA, of patch management specialist Patchlink.

"Between the backlog of unpatched issues, and the chances of new vulnerabilities being discovered in adjacent areas, PatchLink sees a clear trend towards exploits coming out before patches are available - and 'Exploit Wednesday' is likely to become a reality sooner rather than later."

Microsoft hinted at the potential number of patches heading IT professionals' way last week in its Security Bulletin Advanced Notifications service. But it remained tight lipped about just how many would be deemed critical.

In light of the increased volume of patches, McAfee advised organisations to review deployment initiatives. Similarly, PatchLink said IT administrators should ensure their systems are up to date and ready to be patched as soon as patches are made available.

"Because security vulnerabilities are usually errors unintentionally put in code by programmers, the chances of finding a new vulnerability in an adjacent area of code or functionality is much more likely than your chances of identifying a brand new and unique vulnerability," said Bentley.

Maggie Holland

Maggie has been a journalist since 1999, starting her career as an editorial assistant on then-weekly magazine Computing, before working her way up to senior reporter level. In 2006, just weeks before ITPro was launched, Maggie joined Dennis Publishing as a reporter. Having worked her way up to editor of ITPro, she was appointed group editor of CloudPro and ITPro in April 2012. She became the editorial director and took responsibility for ChannelPro, in 2016.

Her areas of particular interest, aside from cloud, include management and C-level issues, the business value of technology, green and environmental issues and careers to name but a few.