Microsoft urges users to update PCs in security warning

Microsoft on Wednesday said that users of its Windows operating system should install updates after a cybersecurity company accidentally published a guide on how to exploit vulnerabilities in the service. 

CNN reported that the firm Sangfor mistakenly tweeted in late May a proof-of-concept showing that they had found a security flaw in the Windows Print Spooler service, which allows multiple people to access the same printer. 

While the firm eventually deleted the post, screenshots of it were posted other places online, prompting Microsoft to warn customers that hackers could use the vulnerability to install programs, as well as view or delete data. 

While Microsoft ended support for Windows 7 last year, it issued a patch this week for users to address the security flaw, known as PrintNightmare, adding in an online alert on its website that security updates for Windows Server 2016, Windows 10, version 1607, and Windows Server 2012 will be available “soon.” 

The company said the security update “should be applied immediately to fully protect your systems.” 

Microsoft has faced a wave of scrutiny over reported security issues, including last year when the National Security Agency told the tech giant that a flaw in its Windows system could allow hackers to pose as software companies. 

The Russian state-sponsored SolarWinds hack also targeted Microsoft, along with nine U.S. federal agencies and dozens of private sector groups. 

In March, Microsoft announced that it had found new vulnerabilities in its Exchange Server program, adding at the time that it had assessed with “high confidence” that a hacking group known as HAFNIUM, a Chinese state-sponsored group, was exploiting the vulnerabilities. 

Anne Neuberger, the deputy national security adviser for cyber and emerging technology, said late last month that roughly 140,000 organizations were left vulnerable to attack by HAFNIUM and other groups, though she said Microsoft quickly released a patch that reduced this number to less than 10 within a week. 

While the U.S. has not formally attributed the exploitation, Neuberger said the Biden administration was looking to do so “in the coming weeks.”