Microsoft issues critical security patches, but leaves zero-day flaws at risk