'Void Banshee' Exploits Second Microsoft Zero-Day

Microsoft reclassified CVE-2024-43461 as a zero-day being exploited in the wild by the Void Banshee group in an attack chain that leverages a separate MSHTML vulnerability (CVE-2024-38112) to spoof HTA/URL handling and deliver Atlantida malware; the flaw affects all supported Windows versions, Microsoft and CISA have issued advisories, and organizations are urged to apply the July and September security updates to mitigate the active exploitation.