Krebsonsecurity posted that BOTH Adobe and Microsoft released patches for “Critical” updates. The term “Critical” when used by Microsoft means “these vulnerabilities could be exploited to fully compromise vulnerable Windows systems without any help from users.” Or in other words, you have no idea that you just got infected with a keylogger and it just sent your username and password for your bank account to Mother Russia.

The worst part about these updates is what they do NOT fix. There is still a well documented security flaw in Internet Explorer 6 through 8 that allows you to easily be infected simply by browsing a website. While MS did give us a “Fix” that helps some of the flaws, it completely ignores others that are widely used today.

Although the XVU Drive supports Adobe Flash, it does not run a Windows based operating system, and runs a “hardened” operating system, making it much harder to infect. Adobe’s issues should not affect XVU Drive users, and the Windows issues will not affect us at all.

Please be sure to run your updates on both Windows and any Adobe products you run, and be sure to use your XVU Drive whenever you access your bank, facebook, email, or any other secure site.

You’re probably asking yourself “Why is XVU telling me about something that happens on a server? I’m not a techie, I don’t run a server, why do I care?” Well, some server exploits are bad enough that they even threaten you as a user of the web. Lemme ‘splain.

ARSTechnica reported an “Extremely critical” bug that “threatens more than 200,000 sites”. 200,000 sounds like a big number, but in the grand scheme of the internet, it’s not that many. However, look at some of the sites that are in that list:

http://www.twitter.com/
http://www.yellowpages.com/
http://www.whitepages.com/
http://www.hulu.com/
http://www.groupon.com/
http://www.scribd.com/
http://www.lumosity.com/
http://www.urbandictionary.com/

and, well, 200,000 more like that.

“Ok, so it attacked a bunch of sites I go to every day. How does that affect ME?!” Well, I’m glad you asked. According to this post “An attacker can execute any ruby code he wants including system(“unix command”).” This means that if the site was exploited, the attacker could infect you just by browsing the site. Perhaps infecting the site with the new Java 0-day exploit and installing a keylogger on your computer.

If you have visited any of the above sites, please be sure to run a thorough virus scan, and be sure to use your XVU Drive to access secure sites until we’re all sure this is thoroughly patched.