December Patch Tuesday fixes three zero-days, including one that hijacks Windows devices

Microsoft's Patch Tuesday updates address 57 vulnerabilities across Windows, Office, and related services, including an actively exploited Windows privilege-escalation zero-day (CVE-2025-62221) and two publicly disclosed remote code execution issues (CVE-2025-64671, CVE-2025-54100); PowerShell will now warn when Invoke-WebRequest fetches pages without safe parameters to reduce accidental script execution, and users are advised to apply the updates immediately following the provided steps.