惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
GbyAI
GbyAI
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
博
博客园 - 三生石上(FineUI控件)
美
美团技术团队
Last Week in AI
Last Week in AI
WordPress大学
WordPress大学
L
LangChain Blog
雷峰网
雷峰网
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
博
博客园 - 叶小钗
Engineering at Meta
Engineering at Meta
腾
腾讯CDC
Recent Announcements
Recent Announcements
The Register - Security
The Register - Security
有赞技术团队
有赞技术团队
Blog — PlanetScale
Blog — PlanetScale
博
博客园 - Franky
博
博客园 - 司徒正美
The Cloudflare Blog
Google DeepMind News
Google DeepMind News
T
Tailwind CSS Blog
C
Check Point Blog
小众软件
小众软件
V
Visual Studio Blog
V
V2EX
F
Full Disclosure
J
Java Code Geeks
MongoDB | Blog
MongoDB | Blog
罗
罗磊的独立博客
人人都是产品经理
人人都是产品经理
量
量子位
Apple Machine Learning Research
Apple Machine Learning Research
F
Fortinet All Blogs
Microsoft Security Blog
Microsoft Security Blog
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
博
博客园 - 【当耐特】
博
博客园_首页
Y
Y Combinator Blog
N
Netflix TechBlog - Medium
酷 壳 – CoolShell
酷 壳 – CoolShell
Stack Overflow Blog
Stack Overflow Blog
Recorded Future
Recorded Future
G
Google Developers Blog
Vercel News
Vercel News
大猫的无限游戏
大猫的无限游戏
Microsoft Azure Blog
Microsoft Azure Blog
U
Unit 42
爱范儿
爱范儿
Jina AI
Jina AI

Latest from TechRadar in Security

Robots are fighting wars and helping to quash riots — China is arming riot police with squads of AI controlled drones and Ukraine wants to man the frontlines with 25,000 robots US security agency still using Mythos despite ban – government using new security tool despite Pentagon's… Struggling to launch Teams? Microsoft recalls update causing failed startup and infinite loading loops –… NIST is cataloging so many vulnerabilities it can only assign severity scores to the highest priority threats How to meaningfully measure the effectiveness of cyber resilience 'We've identified a security incident': Vercel breach confirmed after hackers claim stolen data for sale… How EU organizations can turn sovereign cloud theory into action 'Update immediately': 60,000 WordPress websites at risk after experts discover flaw that allows hackers to… 'They mopped the floor with me and pulled every childish game they could': Disgruntled researcher releases second major Windows zero-day — claims Microsoft 'would ruin my life, and they did' 'As threats evolve, Gemini keeps our defenses one step ahead': Google claims its AI helped it block over 8.3… Cisco tells Webex users to patch critical security flaws immediately, as experts find its Wi-Fi boxes may be filling their disks with undeletable data every day Microsoft experts warn North Korean attackers target macOS users with 'a highly reliable infection chain' to steal passwords, financial data and more — here's how to stay safe Solving the shadow IT crisis in travel Agentic swarms will change how everyone uses AI – but how can organizations deploy them securely? Europol launches Operation PowerOFF — warns 75,000 DDoS users and takes down 53 domains China completes testing on ‘deep-sea electro-hydrostatic actuator’ capable of slicing undersea cables as deep as 3.5 kilometers – new compact subsea vessel testing bridges the ‘last mile’ and could deploy in 2026 Many are still leaving the door open': Security experts warn FIFA World Cup partners could be putting customers at… 'Anyone with $10 could have walked straight through': Report warns this legit-looking software is actually… 'This is not a traditional coding error': Experts flag potentially critical security issues at the heart of Anthropic's MCP, exposes 150 million downloads and thousands of servers to complete takeover Your OpenClaw agents can empty your inbox and leak your data. Here's how to secure them Russia hits European thermal power plant in attempted ‘destructive’ cyberattack – Pro-Kremlin hackers are engaging in ‘riskier and more reckless behavior’ in latest attempt to cripple Western critical infrastructure The war in Iran is reaching cyberspace - here’s how to prepare Millions of hotel goers may have been exposed after hackers steal data and leak it on Telegram 'Every Apple user needs to know about this nasty scam': Fake warnings tell users their iCloud data will be… Dozens of WordPress plugins hijacked to target thousands of sites 'We are currently being extorted' — crypto giant Kraken says it is facing extortion attack, here's… McGraw Hill becomes latest to see its Salesforce data hacked Over 100 Chrome Web Store extensions found stealing user data from thousands of accounts OpenAI reveals its Mythos rival designed for cybersecurity pros When cyberattacks are inevitable, recovery becomes the strategy Closing the cloud complexity gap 'It's more common than you think': Experts reveal how hackers are trying to hijack your inbox with these… 'This wasn’t just phishing — it was a full-service cybercrime platform': FBI reveals takedown of notorious W3LL phishing operation targeting thousands of victims From cloud to Agentic AI: Why security must evolve faster than innovation Basic-Fit gym group data breach exposes details of over 1 million members — here's what we know ‘Authorities can ask them to hand over data’: Report claims over 80% of Europeans don’t trust US and Chinese businesses to handle their data – Europe is desperate for homegrown AI, cloud, and telecoms as the rift with the US grows Booking.com confirms reservation data breach — tells customers hackers 'may have been able to access certain… Agility is the key to protecting against Malware-as-a-Service (MaaS) Rockstar hackers publish 78.6 million stolen records — but many of us will be disappointed Adobe issues emergency security patch — Reader and Acrobat users need to update now What 2025 taught us about the importance of resilience in retail Governing the hidden risks of generative AI in the enterprise Russia launched a covert operation to deploy undersea sabotage vessels in UK waters while the world was distracted by the Middle East - UK threatens Putin with ‘serious consequences’ if subversion continues 'Industrial-scale scam operations': Global criminal organization operated slave compounds in Asia behind huge malware-as-a-service hydra targeting 35+ government agencies monthly OpenAI flags third-party data issue — all macOS users should update now Hackers use Claude and ChatGPT in 'a significant evolution in offensive capability' to breach government agencies, leak hundreds of millions of citizen records 'This is not your typical run-of-the-mill malware': CPUID download page hacked and tools replaced with links… How businesses can turn AI pilots into scalable solutions ‘No Decision’ is the new breach: Why inaction is becoming a career risk for CISOs in 2026 Rockstar confirms major third-party data breach: GTA VI maker says 'no impact on our organization or our… '$15K bill destroyed a solo developer’s startup': How hackers are using leaked Google API keys to… Adobe Reader users beware — experts flag months-old security flaw using booby-trapped PDFs to scope out victims Top WordPress Slider plugin hijacked to spread malware — here's what to look out for No, Elon Musk doesn't want to give you a $5,000 tax refund — it's a scam, here's what to look out… ‘It’s a potential national security threat’: Proton study finds over 3,500 US legislators’ official emails leaked and exposed on the dark web Microsoft warns worrying security flaw exposed over 50 million Android users, says 'user credentials and financial… Google Chrome rolls out a new tool to try and stop infostealer malware in its tracks Breach exposes sensitive LAPD files stored in city attorney system ‘FlamingChina’ hacker claims to have stolen over 10 petabytes of advanced military data from China’s National Supercomputing Center in possibly the biggest hack of all time Mac users beware — experts say this attack 'stood out immediately' by making a major change to try… Now that's different - hackers use miniature SVG images to try and hide credit card stealer Closing the implementation gap in America's cyber strategy UK NHS chief champions Palantir’s 'outstanding results’ in England, pushes for deeper rollout despite… French email provider accidentally leaked 40 million records — L’Oreal, Renault, French government data… Tame your AI gremlins before the chaos becomes permanent NHS Scotland domains reportedly found serving adult content and illegal sport streams 'This creates a layered form of obfuscation': New report says criminals are using emojis to avoid detection Top open source AI platform Flowise hit by maximum-level security issue US agencies warn Iranian hackers are targeting American critical infrastructure — causing 'disruptive effects… Third-party integration tool Anodot data breach hits Snowflake customers Always-on AI Agents put everything hackers could ever want behind a single attack surface When infrastructure decisions shape growth outcomes 'This puts organizations at risk of credential theft, data manipulation and broader compromise': UK government, Microsoft warn Russian hackers are hitting TP-Link home routers to hijack internet traffic 'A new frontier model trained by Anthropic that we believe could reshape cybersecurity': Project Glasswing wants to use AI to prevent AI cyberattacks — but will 'overeager' Claude Mythos do more damage than help? Microsoft flags China-based hackers using vicious new 'rapid attack' zero-days to launch ransomware at targets… 'By combining trusted platforms with legitimate tools, the threat actor reduces visibility and increases the… 'Stolen session cookies render MFA irrelevant': How $900-per-month turnkey malware is putting enterprise-grade… 'Verify before you act': security expert reveals the simple steps you can take to stay safe from deepfakes I can't think of anything that's off limits to them': FBI slams cybercriminals for attacking schools,… 'I was not bluffing Microsoft, and I'm doing it again': apparently disgruntled researcher leaks worrying… Understanding the ‘espionage ecosystem’ threat Goodnight REvil and GandCrab? Police think they've identified two of the biggest cybercrime bosses around Why modern cyber conflict is partly a global skills challenge 'Your login credentials may already be slipping into the hands of a cybercriminal': Hackers target LinkedIn… SparkCat malware returns to target Android and iOS users, hiding in innocent apps to try and steal your details One of the largest corporate espionage and data breach scandals in digital history': New "BrowserGate" report claims LinkedIn secretly scans user browsers for installed extensions and collects device data This devious VENOM phishing campaign targets business executives by name — so watch what you click on Backups won’t save you from this version of ransomware Your marketing stack is an attack surface – is security watching? AI agents can only be trusted as Junior Engineers Top museums hit by apparent cyberattack on Vivaticket — Louvre and other institutions affected Uffizi galleries confirms it was hit by cyberattack — but claims nothing was stolen Time for an upgrade? Report warns outdated operating systems could be the 'unnecessary risk' your business… Building private AI: control, compliance and competitive edge 'Skipping a beat on resilience investment isn’t an option any more': IT incidents can cost firms huge amounts - here's how to stay on top of issues 'The most powerful weapon is not always a missile': How Iranian "Charming Kitten" hackers used old… 'Growing 3x faster than police staffing': Surge in cybercrime and new laws on ransomware payment could put UK… The invisible threat hidden in clear view: how Unicode characters are being weaponized to hide malicious commands from… Be careful what you click - hackers use Claude Code leak to push malware Hims and Hers reveal cyberattack — customer support system hacked and personal info stolen, here's what we…
An ancient Microsoft Excel security flaw could let hackers hijack your entire system, so patch now
Sead Fadilpašić · 2026-04-16 · via Latest from TechRadar in Security
Someone using Excel on a Laptop.
(Image credit: Microsoft)
  • CISA adds 18‑year‑old Excel flaw (CVE‑2009‑0238) to KEV catalog
  • Vulnerability enables RCE via malicious Excel files, patched long ago
  • Outdated systems still at risk; agencies ordered to patch by April 28

Incredible as it may sound, there are still systems out there vulnerable to 18-year-old Microsoft Excel vulnerabilities, and unsurprisingly, cybercriminals are taking advantage of that fact.

The US Cybersecurity and Infrastructure Security Agency (CISA) recently updated its Known Exploited Vulnerabilities (KEV) catalog - a list of flaws confirmed to be exploited in the wild, to add CVE-2009-0238, a bug in Microsoft Excel first discovered in 2009.

According to the National Vulnerability Database (NVD), the bug allows threat actors to execute arbitrary code (RCE) via a crafted Excel document “that triggers an access attempt on an invalid object”.

Article continues below

A week to patch

This vulnerability, given a severity score of 8.8/10 (high), was first observed delivering the Trojan.Mdropper.AC malware.

It affects Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac. It was patched literally ages ago.

Still, it seems that there are systems out there still using this severely outdated, and thus vulnerable, software. CISA added the bug to KEV on April 14 2026, and gave FCEB agencies a week’s time to patch up (April 28).

Other than that, we don’t know much about who is exploiting the bug and to what end. CISA could not say if the flaw was being used in ransomware infections, or not. We can assume that the attacks include a phishing email with a weaponized Excel document.

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Furthermore, if we assume that versions not on the list are safe, that would mean anyone running these is not at risk:

Excel 2007 (SP2 and later)
Excel 2010
Excel 2013
Excel 2016
Excel 2019
Excel 2021
Excel for Microsoft 365 (all versions)
Excel for Mac (versions newer than 2008).

Via The Register

Best antivirus software header

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。