Microsoft has confirmed that Internet Explorer (all versions) has a bug that allows the browser to run software as you on your computer. Making it happen is rather technical, but it can happen when you go to a "specially crafted"¹ web site that downloads the code into the browser than causes the browser to execute the code as if it were part of the browser's regular code. The attacks "in the wild"² use Flash on IE V9, 10, and 11.

What to do

There is no patch available from Microsoft yet. Do not use Internet Explorer to visit new or unknown sites and pages. Consider disabling Flash. You can use Mozilla's Firefox, Google's Chrome, or other web browsers. They are not subject to this bug.

References:

• Microsoft's Security Advisory
• Gizmodo's report
• Ziff-Davis' report
• CNet's report

¹ Meaning a page where the author has carefully written code for the page that activates the bug.
² A page or site that is not under the software author's (Microsoft) or discoverer's (Fire Eye) control where code that activates the bug has been found.