I'm not sure why Microsoft has been sitting on these patches for several security cycles now, the fix has been publicly confirmed (without context) since mid-November, and other vendors took advantage of the embargo to stealthily update their software/platforms before Spectre/Meltdown went public.

In all cases, Microsoft's fix for Windows 7 and Windows 10 will go live on January 9th; until then your best bet is to update your browser (and don't use Edge or IE11 since they won't be updated out-of-band) and manually download and install the patches linked in the article.

Seems a bit crazy that MS was not ready to go with the patch and really should have already rolled it out. There are already PoC out of the exploit.