Bad luck, Windows 10 users. No fix yet for ransomware-exploited bug

Patch Tuesday Patch Tuesday has arrived, and Microsoft has revealed one flaw in its products under active exploitation and 11 critical issues in its code to fix. Redmond delivered fixes for more than 120 flaws this month; none are rated with a CVSS severity score of nine or higher. The one that deserves most attention is CVE-2025-29824, an elevation of privilege (EoP) hole in the Windows Common Log File System Driver, because it is already being exploited. In a separate note, Microsoft explained the vulnerability is being exploited by a crew it has designated as Storm-2460, which uses the bug to deliver ransomware it’s dubbed PipeMagic. Victims have been found in the US, Spain, Venezuela, and Saudi Arabia. The 7.8-rated flaw allows an attacker to elevate privileges up to system level thanks to a use-after-free() flaw in the aforementioned driver. The issue affects all versions of Windows Server up to 2025 and Windows 10 and 11. Windows Server and Windows 11 have been patched, but Windows 10 awaits a fix. "The updates will be released as soon as possible, and when they are available, customers will be notified via a revision to this CVE information," Redmond wrote, regarding patches for Windows 10. This appears to be a common problem this month, with many of the patches excluding Windows 10 for the moment. We've asked Microsoft for clarification on release dates and what the issue is. Windows 10 is approaching end of life but it's not there yet. All of the critical flaws all a...