Aurora patch update

Looks like Microsoft is going to release an out-of-band patch for the “Aurora” security hole made (in)famous by unknown Chinese assailants, Google, and various dissidents.

Ed Bott has a full report, with anticipation that a release date for the out-of-band patch (which is to say, a security patch that doesn’t wait for the Black Tuesday cycle) today.

The Web site Darkreading has had a string of articles on the topic. Good reading if you’re concerned.

UPDATE: Microsoft has released advanced notification which says the patch – a cumulative IE rollup – should be available in the next few hours. If it’s like most cumulative IE rollups, it’ll be full of bugs, some of which may affect Windows itself. We remain at MS-DEFCON 2: Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don’t do it.