Photo 
 
 SEATTLE — In case those with personal computers running Windows XP still need a reason to replace or update their machines, Microsoft has just given them a great one with the disclosure of a nasty security hole in the company’s web browser, Internet Explorer. 
 
 Microsoft issued a warning about the security hole in an advisory on Saturday, warning that attackers can exploit the flaw simply by persuading people to visit websites, where malicious code could be used to steal data from their computers. The company said it was aware of “limited, targeted attacks” that tried to exploit the flaw, though it did not provide more details about them. 
 
 Although the security flaw affects various versions of Internet Explorer browsers running on newer computers with the Windows 7 and Windows 8 operating systems, the problem is especially troubling for the millions of people still using Windows XP. Because Microsoft ended technical support for Windows XP this month, the company will not issue any security updates for the operating system, including for the flaw disclosed on Saturday. 
 
 The flaw was discovered by FireEye Research Labs, part of the security company FireEye Inc. 
 
 Windows XP was first introduced by Microsoft more than 12 years ago. Computers running the software are comically outdated compared with later machines. That still does not change the fact, however, that more than a quarter of the computers connected to the Internet are still running Windows XP, according to NetMarketShare. 
 
 Microsoft is working on a final software update to remedy the security hole in Internet Explorer on its modern operating systems. Internet Explorer versions 6 through 11, the latest, are affected. In the meantime, the company recommends several precautions, including making sure that Internet Explorer is configured to run in enhanced protected mode, to lessen the risks from the security flaw. 
 
 One remedy for Windows XP users is to use an alternative Web browser such as Chrome or Firefox. The security hole should also get people thinking seriously about upgrading to a computer running a newer operating system. ||||| The logo of Microsoft Corp.'s Internet Explorer 9 is displayed on a computer monitor in Washington, on March 15, 2011. Bloomberg 
 
 A newly discovered security hole in Microsoft Corp.'s MSFT -0.78% Microsoft Corp. U.S.: Nasdaq $39.69 -0.31 -0.78% AFTER HOURS $39.75 +0.06 +0.15% P/E Ratio 14.75 Market Cap $327.86 Billion Dividend Yield 2.82% Rev. per Employee $840,333 More quote details and news » MSFT in Your Value Your Change Short position Internet Explorer—the default Web browser for many users—could be particularly troubling for those still running Windows XP. 
 
 WSJ cybersecurity reporter Danny Yadron has details on a new security flaw discovered in Microsoft's Internet Explorer that potentially impacts 300 million users of Windows XP. Photo: Getty Images. 
 
 Microsoft on Sunday warned about a flaw affecting versions 6 through 11 of its flagship browser. The coding flaw would allow hackers to have the same level of access on a network computer as the official user, Microsoft said, which is a best-case scenario for intruders. 
 
 The company said it is aware of "limited, targeted attacks" that attempt to exploit the flaw. Microsoft didn't elaborate. 
 
 FireEye Inc., FEYE -2.04% FireEye Inc. U.S.: Nasdaq $39.94 -0.83 -2.04% AFTER HOURS $39.71 -0.23 -0.58% P/E Ratio N/A Market Cap $5.79 Billion Dividend Yield N/A Rev. per Employee $96,276.5 More quote details and news » FEYE in Your Value Your Change Short position a security company that claimed credit for finding the hole, described it as part of a hacking campaign against U.S. financial and defense companies. It didn't provide further details. 
 
 FireEye said attacks have mainly been targeted at Internet Explorer 9 through Internet Explorer 11. 
 
 The bug affects the browser when used on multiple Microsoft operating systems. But the situation poses a special concern for people still using Windows XP. 
 
 The software was introduced in 2001, and Microsoft on April 8 stopped supporting XP with software updates—including security patches for the operating system and its browser. XP can run up to Internet Explorer 8. 
 
 "XP users are not safe anymore and this is the first vulnerability that will be not patched for their system," Symantec Corp. SYMC +1.04% Symantec Corp. U.S.: Nasdaq $20.37 +0.21 +1.04% AFTER HOURS $20.37 0.00 0.00% P/E Ratio 16.30 Market Cap $14.09 Billion Dividend Yield 2.95% Rev. per Employee $316,233 More quote details and news » SYMC in Your Value Your Change Short position researcher Christian Tripputi wrote in a blog post for the data-security company. 
 
 Windows XP, though outdated and plagued with security flaws, still runs on some 300 million machines. Microsoft offers extended support for corporate clients still running XP, but at a hefty price. 
 
 Despite its past statements, Microsoft could decide to make an exception and issue a patch that would aid XP users. The company, based in Redmond, Wash., didn't immediately respond to a request for comment. 
 
 "On completion of this investigation, Microsoft will take the appropriate action to protect our customers," Microsoft said in a security bulletin. 
 
 Sunday's disclosure, to a certain extent, was predictable. Microsoft had publicized widely its plans to stop supporting XP, and the dire consequences for some users were well-known. 
 
 But it isn't clear whether anyone expected a major XP flaw to be found three weeks after Microsoft ended support. 
 
 Morgan Marquis-Boire, a well-known security researcher, posted a link to Symantec's warning on his Twitter account Sunday, including the phrase "*gets popcorn*" to indicate that he expects a furor to result. 
 
 Write to Danny Yadron at danny.yadron@wsj.com
– A new security headache for the estimated 56% of Web users who use Internet Explorer: A major security flaw has surfaced in some versions of the browser, leaving users open to a "remote code execution vulnerability," which "means a bad guy can make a target computer run software after a successful attack," Recode explains. Microsoft says most attacks occur when a user clicks on a link that leads to a malicious website and the bug affects every Explorer version from 6 to 11. Microsoft plans to roll out a security update for current versions of Windows, but it looks like Windows XP users are on their own, the Wall Street Journal reports. Microsoft ended support for the outdated operating system earlier this month, and although it still runs on around 300 million machines, it's not clear whether Microsoft will make an exception and issue a security patch for the latest flaw. "XP users are not safe anymore and this is the first vulnerability that will be not patched for their system," a Symantec researcher warns.