Update Windows: Record Patch Tuesday fixes flaw already under attack
Microsoft's October Patch Tuesday fixes 1,413 flaws, including an actively exploited Windows Shell zero-day.
Microsoft's October Patch Tuesday addresses a record 1,413 vulnerabilities, including the actively exploited Windows Shell flaw CVE-2026-96951 (CVSS 8.8). The bug bypasses Mark of the Web warnings but requires a user to open a crafted file or link. Two other flaws were publicly disclosed before patching: CVE-2026-108398 (CVSS 8.8), an untrusted .NET Framework search path that can bypass Windows Defender Application Control, and CVE-2026-92707 (CVSS 5.3), a MessagePack-CSharp issue that can let a remote attacker exhaust memory. Microsoft attributes the rising fix volume partly to greater use of AI in vulnerability discovery.
86