The NSA found a 'severe' security flaw with Microsoft Windows 10, and it's urging all users to do a
The National Security Agency is urging all Windows 10 users to update their software after detecting a "severe" security flaw in the operating system, the agency announced Tuesday.
The NSA first detected the flaw and alerted Microsoft, prominent security researcher Brian Krebs first reported. NSA Director of Cybersecurity Anne Neuberger confirmed that the agency told Microsoft about the flaw in a call with reporters Tuesday morning.
Microsoft confirmed the flaw and rolled out a patch update for Windows 10, as well as Windows Server 2016 and Windows Server 2019, on Tuesday afternoon. Microsoft hasn't found any evidence that the flaw has been actively exploited, but urged all Windows users to install the latest update.
The security flaw allows attackers to target users of unpatched Windows systems with malware that mimics the digital signature of a trusted provider. If people downloaded the malicious file, hackers could access "confidential information" stored on their computers, according to Microsoft.
It's exceedingly rare for a federal agency to tell a company about a cybersecurity flaw — according to Neuberger, this is the first time the NSA disclosed a vulnerability to Microsoft.
In an email to Business Insider, Amit Yoran, founding director of the Department of Homeland Security's US Computer Emergency Readiness Team and CEO of Tenable, underscored how unusual this disclosure is.
"For the US government to share its discovery of a critical vulnerability with a vendor is exceptionally rare if not unprecedented," Yoran said. "These are clearly noteworthy shifts from regular practices and make this vulnerability worth paying attention to."