The logo of Microsoft Corp.'s Internet Explorer 9 is displayed on a computer monitor in Washington, on March 15, 2011. Bloomberg 
 
 A newly discovered security hole in Microsoft Corp.'s MSFT -0.78% Microsoft Corp. U.S.: Nasdaq $39.69 -0.31 -0.78% AFTER HOURS $39.75 +0.06 +0.15% P/E Ratio 14.75 Market Cap $327.86 Billion Dividend Yield 2.82% Rev. per Employee $840,333 More quote details and news » MSFT in Your Value Your Change Short position Internet Explorer—the default Web browser for many users—could be particularly troubling for those still running Windows XP. 
 
 WSJ cybersecurity reporter Danny Yadron has details on a new security flaw discovered in Microsoft's Internet Explorer that potentially impacts 300 million users of Windows XP. Photo: Getty Images. 
 
 Microsoft on Sunday warned about a flaw affecting versions 6 through 11 of its flagship browser. The coding flaw would allow hackers to have the same level of access on a network computer as the official user, Microsoft said, which is a best-case scenario for intruders. 
 
 The company said it is aware of "limited, targeted attacks" that attempt to exploit the flaw. Microsoft didn't elaborate. 
 
 FireEye Inc., FEYE -2.04% FireEye Inc. U.S.: Nasdaq $39.94 -0.83 -2.04% AFTER HOURS $39.71 -0.23 -0.58% P/E Ratio N/A Market Cap $5.79 Billion Dividend Yield N/A Rev. per Employee $96,276.5 More quote details and news » FEYE in Your Value Your Change Short position a security company that claimed credit for finding the hole, described it as part of a hacking campaign against U.S. financial and defense companies. It didn't provide further details. 
 
 FireEye said attacks have mainly been targeted at Internet Explorer 9 through Internet Explorer 11. 
 
 The bug affects the browser when used on multiple Microsoft operating systems. But the situation poses a special concern for people still using Windows XP. 
 
 The software was introduced in 2001, and Microsoft on April 8 stopped supporting XP with software updates—including security patches for the operating system and its browser. XP can run up to Internet Explorer 8. 
 
 "XP users are not safe anymore and this is the first vulnerability that will be not patched for their system," Symantec Corp. SYMC +1.04% Symantec Corp. U.S.: Nasdaq $20.37 +0.21 +1.04% AFTER HOURS $20.37 0.00 0.00% P/E Ratio 16.30 Market Cap $14.09 Billion Dividend Yield 2.95% Rev. per Employee $316,233 More quote details and news » SYMC in Your Value Your Change Short position researcher Christian Tripputi wrote in a blog post for the data-security company. 
 
 Windows XP, though outdated and plagued with security flaws, still runs on some 300 million machines. Microsoft offers extended support for corporate clients still running XP, but at a hefty price. 
 
 Despite its past statements, Microsoft could decide to make an exception and issue a patch that would aid XP users. The company, based in Redmond, Wash., didn't immediately respond to a request for comment. 
 
 "On completion of this investigation, Microsoft will take the appropriate action to protect our customers," Microsoft said in a security bulletin. 
 
 Sunday's disclosure, to a certain extent, was predictable. Microsoft had publicized widely its plans to stop supporting XP, and the dire consequences for some users were well-known. 
 
 But it isn't clear whether anyone expected a major XP flaw to be found three weeks after Microsoft ended support. 
 
 Morgan Marquis-Boire, a well-known security researcher, posted a link to Symantec's warning on his Twitter account Sunday, including the phrase "*gets popcorn*" to indicate that he expects a furor to result. 
 
 Write to Danny Yadron at danny.yadron@wsj.com ||||| A newly discovered flaw affecting several versions of Microsoft’s Internet Explorer has left a significant portion of the world’s web browsers vulnerable to attack. 
 
 Disclosed in an unusual Saturday alert from Microsoft, the flaw is being called a serious “Zero Day” vulnerability by security company FireEye, which claims it affects more than 56 percent of the world’s web browsers currently in use. 
 
 It’s a remote code execution vulnerability, which in English means a bad guy can make a target computer run software after a successful attack. “The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer,” Microsoft’s alert reads. The phrase “arbitrary code” means pretty much any software that the attacker chooses to run. 
 
 In a post to its Security Response Center blog, Microsoft explains that the company has so far seen only “limited attacks” exploiting the vulnerability. It says attacks typically occur when a target has been convinced to click on a link. 
 
 FireEye, in a post of its own has declared the exploit a zero-day vulnerability, so named because they’re undisclosed or leave potential victims with zero days of warning. The company claims a gang of attackers has already launched a campaign exploiting the flaw. 
 
 Microsoft’s full security advisory goes into more detail, explaining that the vulnerability affects every version of the browser from Internet Explorer 6 through 11. FireEye says that most attacks are targeting IE9 through 11, which together account for more than 26 percent of the web browsers currently in use around the world. But when you add in IE versions 6 through 8, you’re talking about more like 56 percent. 
 
 Microsoft says that Internet Explorer 10 and 11 with Enhanced Protected Mode — which is enabled by default on those browsers — protects against attacks exploiting the vulnerability. The company is still investigating the matter and will provide an update when it’s complete. 
 
 FireEye goes into further detail, saying the vulnerability originates in Flash, the animation and video software from Adobe, and can be exploited using a well-known technique (Many technical details here) to access a computer’s memory, where malignant code can be deployed. 
 
 In one scenario, an attacker can create a website that is specifically designed to take advantage of this vulnerability, and then convince people using Explorer to click through. So if you use Explorer, be on the lookout for suspicious-looking email messages with Web links in them. 
 
 So who’s behind the attacks FireEye says are exploiting this new vulnerability? The company doesn’t go into a lot of detail, but it does say it’s an APT Group, which stands for “Advanced Persistent Threat.” FireEye generally saves that designation for the most serious and technically sophisticated of attackers. 
 
 “The APT group responsible for this exploit has been the first group to have access to a select number of browser-based Zero-Day exploits in the past,” FireEye explains. “They are extremely proficient at lateral movement and are difficult to track, as they typically do not reuse command and control infrastructure.” 
 
 FireEye says this same group was tied to a backdoor vulnerability known as Pirpi that appeared in 2010.
– A new security headache for the estimated 56% of Web users who use Internet Explorer: A major security flaw has surfaced in some versions of the browser, leaving users open to a "remote code execution vulnerability," which "means a bad guy can make a target computer run software after a successful attack," Recode explains. Microsoft says most attacks occur when a user clicks on a link that leads to a malicious website and the bug affects every Explorer version from 6 to 11. Microsoft plans to roll out a security update for current versions of Windows, but it looks like Windows XP users are on their own, the Wall Street Journal reports. Microsoft ended support for the outdated operating system earlier this month, and although it still runs on around 300 million machines, it's not clear whether Microsoft will make an exception and issue a security patch for the latest flaw. "XP users are not safe anymore and this is the first vulnerability that will be not patched for their system," a Symantec researcher warns.