Critical security holes have been turning up in Web browsers, anti-virus programs, word processors, spreadsheets and digital media players. "As we start to see the operating system become more secure, the criminals are moving up the application layer trying to attack Office or iTunes or RealPlayer," says Stephen Toulouse, Microsoft security response center program manager.