WMF patch ships, finally
Microsoft shipped MS06-001 yesterday — the official patch for the WMF zero-day disclosed at the end of 2005. Two weeks of cumulative exposure; specific lessons about disclosure timing.
WMF zero-day in the holiday week
A zero-day vulnerability in the Windows Metafile format was disclosed on 28 December. The vulnerability is being actively exploited; Microsoft has yet to ship a patch.