Microsoft has an early holiday present for Windows users: A batch of eight software updates that plug at least 28 security holes in the widely-used operating system and other Microsoft products. Six out of eight of the update bundles earned a “critical” rating, meaning Microsoft views these flaws as so serious that attackers could use them to break into vulnerable machines without any help from victims, save perhaps for convincing those users to visit a malicious or hacked Web site. A critical update for Internet Explorer fixes at least four flaws in the popular browser (both IE6 and IE7). Another patch bundle addresses five vulnerabilities that can be exploited through ActiveX controls, a feature specific mainly to IE. Microsoft also issued patches to fix a pair of flaws in the way Windows handles “Windows Metafile” or WMF image files, vulnerabilities that once again could be exploited when an unpatched Windows