“Microsoft did not indicate they were patching this vulnerability, so it was a (welcome) surprise when the patch went live.”
Microsoft patched two zero-days and didn’t flag either as exploited at first. One was a malicious backdoor driver signed with a valid Microsoft Hardware Publisher Certificate, which Sophos found back in December. The other, CVE-2024-29988, bypasses the fix for CVE-2024-21412, which bypassed the fix for CVE-2023-36025. SmartScreen is now a chain of patches that each fail to finish the job. Admins get 150 bugs this month and have to read researcher blogs to learn which ones matter.