December Patch Tuesday fixes three zero-days, including one that hijacks Windows devices

Malwarebytes reports that December Patch Tuesday fixes three zero-days, including one that hijacks Windows devices, with the updates addressing a total of 57 Microsoft security vulnerabilities. The three zero-days comprise CVE-2025-62221, an actively exploited privilege-escalation bug in the Windows Cloud Files Mini Filter Driver; CVE-2025-64671, a GitHub Copilot for JetBrains remote code execution vulnerability; and CVE-2025-54100, an RCE issue in Windows PowerShell.

PowerShell itself has been updated with a new warning that will alert users when the Invoke-WebRequest command fetches web pages without safe parameters, aimed at preventing accidental script execution from web content and recommending the -UseBasicParsing switch. The article notes there is no explicit Microsoft statement tying the new Invoke-WebRequest warning directly to ClickFix campaigns, but it addresses the abuse pattern of tricking users into running web-fetched PowerShell code.

Windows 10 users will see only security updates and fixes for bugs introduced by prior updates, as Microsoft isn’t releasing new features for Windows 10.