Microsoft has killed at least two security bugs linked to the compromised malware developer Hacking Team, including a critical remote-code execution hole that worked against people using the latest version of Internet Explorer on Windows 7 and 8 machines.

The IE vulnerability was discovered in an e-mail a security researcher sent to Hacking Team executives, according to a blog post published Tuesday by researchers from security firm Vectra Networks. In the message, a security researcher offered to sell proof-of-concept attack code exploiting the vulnerability, which was significant because it worked against what is widely regarded as Microsoft's most secure versions of Windows and IE.

"Are you by any chance interested in a PoC (DEP violation) last update to IE11, running on Win7 and Win 8.1?" the researcher wrote, according to the Vectra Networks blog post. "Let me know."

There's no evidence Hacking Team purchased the attack code, and there are indications it may not have worked reliably. Still, the Vectra Networks researchers were able to pull details from the exchange that allowed them to figure out the vulnerability was real. The company was one of three credited by Microsoft as privately reporting the vulnerability, which is indexed as CVE-2015-2425. There are no indications it's being actively exploited in the wild at the moment.

That's not all

A separate vulnerability in Windows, designated as CVE-2015-2387 , was more directly linked to Hacking Team. It was reported to Microsoft by Google's Project Zero and Morgan Marquis-Boire, director of security at First Look Media, who in turn found it in the Hacking Team data dump. While the exploit results in only an escalation of privileges—and hence earned only a rating of "important" from Microsoft—it's likely the means by which a separate Hacking Team attack exploiting Adobe Flash was able to bypass the Google Chrome sandbox . By combining the Flash exploit with the one for Windows, Hacking Team was able to break out of the security perimeter and surreptitiously install malware on targeted computers.

The Microsoft updates—which were published as part of its regularly scheduled Patch Tuesday release cycle—bring to five the number of zero-day vulnerabilities that have been fixed following the 400-gigabyte leak of confidential Hacking Team e-mails, sales invoices, and marketing materials. Adobe patched one previously unknown vulnerability in Flash last week and two more earlier today.