[Updated] May Tuesday's corrective updates came out with hotfix for the new "ZombieLoad" processor vulnerability OnMSFT.com

Microsoft has released new Patch Tuesday updates for all supported versions of Windows 10, including the May 2019 update. All Windows initiated users running version 18356.30 or later will receive version 18362.113 today. Which includes a fix for a new critical vulnerability of modern processors called "ZombieLoad".

Like previous Meltdown and Specter processor failures, ZombieLoad represents a new subclass of speculative runtime secondary channel vulnerabilities. According to the researchers who discovered it, the ZombieLoad attack "resurrects your private browsing history and other sensitive data. It makes it possible to disclose information from other applications, from the operating system, to virtual machines in the cloud, and from secure running environments. "

Techcrunch reports that Microsoft, Apple, Google and Mozilla are releasing all patches today to address this critical vulnerability. For Windows 10 users already running the May 2019 update, here are all fixes included in version 18362.113:

• Provides protections against a new subclass of speculative runtime channel vulnerabilities, called Sampling microarchitectural datafor 64-bit (x64) versions of Windows (CVE-2018-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130). Use the registry settings described in the articles on the Windows and Windows Server client.. (These registry settings are enabled by default for Windows and Windows Server OS releases).
• Fixes a problem that decreases the performance of Internet Explorer when you use roaming profiles or you do not use the Microsoft compatibility list.
• Resolves an issue that may make the text, layout, or cell size narrower or wider than expected in Microsoft Excel when using the tool MS UI Gothic or MS PGothic fonts.

Be aware that after installing this hotfix, you may experience the "0x800705b4" error when launching Windows Defender Application Guard or Windows Sandbox. Microsoft is working on a patch that will be available in an upcoming update.

Patch Tuesday updates for older versions of Windows 10 include all the same fixes for the "ZombieLoad" processor vulnerability. For users still running Windows 10 version 1809, version 17763.503 will provide the following fixes:

• Enables "Retpoline" by default if spectrum variant 2 (CVE-2017-5715) is enabled. Make sure that the previous operating system protections against the Specter Variant 2 vulnerability are enabled by using the registry settings described in the Windows Client and Windows Server articles. (These registry settings are enabled by default for Windows client OS editions, but disabled by default for Windows Server OS editions). For more information on "Retpoline", see Mitigation of Spectrum Variant 2 with Retpoline on Windows.
• Provides protections against a new subclass of speculative runtime channel vulnerabilities, called Sampling microarchitectural datafor 64-bit (x64) versions of Windows (CVE-2018-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130). Use the registry settings described in the articles on the Windows and Windows Server client.. (These registry settings are enabled by default for Windows and Windows Server OS releases).
• Adds "uk.gov" to the HSTS (HSTS) Security Strict Transport Security Top Level Domains for Internet Explorer and Microsoft Edge.
• Fixes a problem that could cause "Error 1309" when installing or uninstalling certain types of .msi and .msp files on a virtual drive.
• Resolves an issue that prevents Microsoft Visual Studio Simulator from starting.
• Resolves an issue that can cause zone transfers between primary and secondary DNS servers through Transmission Control Protocol (TCP) to fail.
• Resolves an issue that causes the Simple Network Management Protocol (SNMP) Management Information Base (SNMP) management information registration to fail when the Windows Management Instrumentation (WMI) provider uses the Windows tool. smi2smir.exe.
• Resolves an issue that may make the text, layout, or cell size narrower or wider than expected in Microsoft Excel when using the tool MS UI Gothic or MS PGothic fonts.
• Security Updates for Microsoft Edge, Internet Explorer, Microsoft Scripting Engine, Windows Platform and Application Framework, Windows Graphics, Windows Storage and File Systems, Windows Cryptography, Microsoft JET Database Engine, Windows kernel, Windows virtualization and Windows Server.

If you are using the older version 1803 of Windows 10 (also known as the April 2018 Update), version 17134.765 is now available for download with the same ZombieLoad patches and more. You can find the complete list of improvements below:

• Provides protections against a new subclass of speculative runtime channel vulnerabilities, called Sampling microarchitectural datafor 64-bit (x64) versions of Windows (CVE-2018-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130). Use the registry settings described in the articles on the Windows and Windows Server client.. (These registry settings are enabled by default for Windows client OS editions, but disabled by default for Windows Server OS editions).
• Adds "uk.gov" to the HSTS (HSTS) Security Strict Transport Security Top Level Domains for Internet Explorer and Microsoft Edge.
• Fixes a problem that could cause "Error 1309" when installing or uninstalling certain types of .msi and .msp files on a virtual drive.
• Resolves an issue that prevents Microsoft Visual Studio Simulator from starting.
• Resolves an issue that can cause zone transfers between primary and secondary DNS servers through Transmission Control Protocol (TCP) to fail.
• Resolves an issue that may make the text, layout, or cell size narrower or wider than expected in Microsoft Excel when using the tool MS UI Gothic or MS PGothic fonts.
• Security Updates for Microsoft Edge, Internet Explorer, Microsoft Scripting Engine, Windows Application Framework and Framework, Microsoft Graphical Component, Windows Storage and File Systems, Windows Cryptography, Windows Data Center Networking, Networking Windows Wireless Network, Windows Virtualization, Windows Core, Windows Microsoft JET Database Engine.

Microsoft has also released new Patch Tuesday updates for versions 1709, 1703, 1607, and 1507 of Windows 10, but all of these updates are only available for earlier versions. Windows 10 Enterprise, Education, and the IoT Enterprise Edition. As usual, report to us in the comments if you are having problems after installing these new patches.

Update: In a blog post about the Microsoft Security Response Center, the company explained that older versions of Windows (normally Windows 8) are also affected by a critical remote code execution vulnerability in Remote Desktop Services. That's why today Microsoft offers security updates for Windows 7, Windows Server 2008 R2, and Windows Server 2008, and the same is true for unsupported versions, such as Windows XP and Windows. The software giant pointed out Today, the vulnerability of ZombieLoad is "vermicular", but it has not been exploited by malicious actors yet.

Further reading: Update, Patch Tuesday, Spectrum, Windows 10, Windows Update April 10, 2018, Windows Update May 10, 2019, Windows Update October 10, 2018, Windows Insider, ZombieLoad