It’s been a crazy week. Last Monday we learned about the Word zero-day vulnerability that uses a booby-trapped Word document attached to an email message to infect Windows PCs. Then, on Friday, came the deluge of Windows exploits collectively identified with their leaker, Shadow Brokers, that appear to originate with the U.S. National Security Agency.

In both cases, many of us believed the sky was falling on Windows: The exploits touch all versions of Windows and all versions of Office. Fortunately, the situation isn’t as bad as was first thought. Here’s what you need to know.

How to protect yourself against the Word zero-day

As I explained last Monday, the Word zero-day takes over your PC when you open an infected Word document attached to an email. The attack takes place from inside Word, so it doesn’t matter which email program or even which version of Windows you’re using.

In a twist I’ve never seen before, subsequent research into the exploit revealed it was first used by nation-state attackers but was then incorporated into garden-variety malware. Both Zach Whittaker at ZDnet and Dan Goodin at Ars Technica reported that the exploit was originally used in January to hack Russian targets—but the same code snippet turned up in a Dridex banking malware email campaign from last week. Exploits aimed at the spook set rarely get unleashed on the world at large, but this one did.