Microsoft has fixed a serious Windows shortcut bug that let hidden commands run when people opened seemingly harmless .lnk files. The flaw had been quietly exploited since 2017 by hackers linked to China, Iran, Russia, and North Korea.