The flaw in IE10 that we reported on February 14, 2014, which then was confirmed by Microsoft a few days later as affecting both IE9 and IE10, has gone from a limited to a full-on attack.