---
title: "Security digest: December 11, 2018"
url: https://erroneo.us/security/2018-12-11/
description: "December 11, 2018 vulnerability digest: 1 brief (Windows Win32k CVE-2018-8639: 2018 EoP Added to…). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2018-12-11
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: December 11, 2018

1 editorial brief.

## Take stock

- Check exposure: Windows Win32k CVE-2018-8639: 2018 EoP Added to KEV . Owners of Windows 7, 8.1, Server 2008, 2012 or early Windows 10/Server 2016/2019 machines that have not installed any update since December 2018, especially internet-facing IIS or SQL Server hosts.
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [Windows Win32k CVE-2018-8639: 2018 EoP Added to KEV](https://erroneo.us/security/briefs/windows-win32k-cve-2018-8639-eop/index.md): Fixed in December 2018 and covered by every Windows update since; the risk is legacy servers that have not been patched in years, which attackers have used this public exploit on to get SYSTEM.

## Known exploited (CISA KEV)

None.

## Critical advisories

None.

---
Source page: https://erroneo.us/security/2018-12-11/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt