Windows 10 is safe they said. Signature/https can be trusted they said.

When even NSA disclose "hacks" you know it's too big

https://wired.com/story/...

Ohhhh boy

@Haxk20 Well, they didn’t say WHEN they found it :) Maybe they used it for couple of months/years.

foliohat on;
@NoToJavaScript or maybe they even asked to have it and now they have another method so they no longer need it.

I dont think it is that easy to exploit that. Ok you can inject it but you still have to perform MIM to a specyfic PC. You need to be targeted to be vunlureable. Spoofing all win 10 in the world and setting up a huge server that will do that is impractical.

I dont say that the update isnt needed, it is, just large scale attack seems pointless. That is just a oppurtunity for PCs that have already been targeted.