Microsoft's October Patch Tuesday fixed a record 1,411 vulnerabilities, including 70 critical ones and three zero-day exploits, with one actively being used to bypass security warnings.
Microsoft releases record-breaking security update
Microsoft released a record-breaking Patch Tuesday update on October 13, addressing 1,411 vulnerabilities, including 70 critical ones, according to BleepingComputer's count. This marks the third time in four months that the company has set a record for the number of vulnerabilities addressed in a single update.Update includes actively exploited zero-day flaw
The update includes three zero-day vulnerabilities, one of which is being actively exploited in the Windows Shell under the reference CVE-2026-96951. Hackers are using this flaw to bypass the Mark of the Web, a security feature that alerts users about files originating from the Internet.AI aids in identifying more vulnerabilities
Microsoft has been using artificial intelligence to identify vulnerabilities in its software code. The Windows team warned customers in July that the use of AI would lead to a higher volume of security updates, as it enables more efficient detection of flaws in the code.AI does not create vulnerabilities, experts say
Dustin Childs, head of threat intelligence at the Zero Day Initiative of TrendAI, noted that while AI plays a role in the increased detection of vulnerabilities, it does not create them. Both defenders and attackers benefit from the earlier detection of vulnerabilities, he said.Vulnerabilities grouped into risk categories
Microsoft has grouped the vulnerabilities into fifteen "risk cohorts" to help businesses manage the volume, with the largest cohort dedicated to Windows file systems and backup. This classification aims to simplify the prioritization of updates for administrators.Another zero-day vulnerability discovered in .NET
James Forshaw, a researcher at Google Project Zero, discovered another zero-day vulnerability in the .NET Framework, which was made public before its fix. An authenticated attacker can exploit this flaw to execute code on a protected process, bypassing WDAC restrictions.Fixes distributed through Windows Update
Microsoft has released updates for the Windows Shell vulnerability, with the fix KB5127648 distributed via Windows Update for Windows 11 24H2, 25H2, and 26H2. The fix has the reference KB5126653 for Windows 11 23H2 and KB5126657 for Windows 10 with extended security updates.Few vulnerabilities exploited in real attacks
Tyler Reguly, deputy director of R&D security at Fortra, noted that less than 1% of the vulnerabilities fixed by Microsoft in 2026 have been exploited in known attacks. This month, the company confirmed the exploitation of a single vulnerability, that of Windows Shell.Exploitation possible via email
In a small business, hackers can exploit the Windows Shell vulnerability through a simple email, bypassing the warning that normally alerts users to potentially malicious attachments. This highlights the potential for serious risks even from seemingly benign interactions.Microsoft recommends update schedules
Microsoft has recommended that administrators delay updates for less than three days and then enforce a restart after a maximum of two days of grace. This aims to balance security needs with operational stability.Windows Shell sees increased vulnerability activity
Tenable researcher engineer Satnam Narang has recorded 26 vulnerabilities in the Windows Shell component fixed since January, compared to three for the entire year of 2025. The October vulnerability is the third exploited by hackers in 2026, indicating a growing focus on this component by attackers.
