“If that sounds familiar it’s because this is the fourth MSHTML vulnerability found to be exploited in the wild so far in 2024.”
Microsoft patched at least 117 holes this month, two already under active attack. One sits in MSHTML, the old Internet Explorer engine. The other lets a booby-trapped Management Console file run code, so Microsoft now blocks untrusted MSC files. That engine has now been exploited in the wild four times this year, and it is only October.