Microsoft patches critical IE bug that was under attack for nearly three years