October Patch Tuesday:a record month
Published
Microsoft fixed a record 1,413 vulnerabilities in October, including a Windows zero-day that attackers are already using. What it is and what to patch first.
On 13 October Microsoft released fixes for 1,413 vulnerabilities, more than it fixed in the whole of 2025. Most affect Windows (1,102), with the rest spread across Office, SharePoint Server, Exchange Server, Azure and developer tools. SecurityWeek puts the surge largely down to AI finding flaws faster, taking Microsoft past 4,000 fixes so far this year.
The zero-day
CVE-2026-96951 is a flaw in Windows Shell that lets an attacker get around Mark of the Web, the tag Windows adds to files downloaded from the internet. Without that tag, SmartScreen and Office Protected View don't warn before a file opens. Microsoft says the flaw is being exploited, but hasn't said by whom. An attacker still has to persuade someone to open a crafted file, for example by email or instant message. CISA added it to its Known Exploited Vulnerabilities catalog the same day.
Two more flaws were public before the fix: CVE-2026-108398, which can bypass Windows Defender Application Control in .NET Framework, and CVE-2026-92707, a denial of service flaw in MessagePack-CSharp.
What to do
- Install October's updates on every Windows device and server, starting with laptops and desktops, where CVE-2026-96951 would arrive in a phishing email.
- Check they actually installed: use your device management reports to find machines that missed the update, rather than assuming they all did.
- Keep email filtering and user awareness up: this flaw only helps an attacker if someone opens the file.
- Plan for more: with monthly fix counts this high, a reliable routine matters more than a scramble. Cyber Essentials expects high and critical updates to be applied within 14 days of release.