Microsoft Patches 61 Flaws, Including Two Actively Exploited Zero-Days

Microsoft's May 2024 Patch Tuesday fixes 61 vulnerabilities, among them two zero-days (CVE-2024-30040 — MSHTML security feature bypass; CVE-2024-30051 — DWM elevation of privilege) actively exploited in the wild and added to CISA's KEV list; the report notes these can enable arbitrary code execution and SYSTEM privileges, have been observed alongside QakBot and other malware, and that administrators should prioritize applying updates. The bulletin also addresses numerous additional RCE and privilege-escalation flaws across Windows components and Chromium-based Edge.