Microsoft's October 2026 Patch Tuesday, released on 13 October, fixed a record 1,411 vulnerabilities, including one zero-day that attackers were already exploiting before the patch existed. For a Perth business the practical answer is simple: make sure this month's Windows updates are actually installed and restarted on every computer, and check that none of your PCs are on a Windows version that has just stopped receiving updates.
What landed this month
According to BleepingComputer's coverage, the 1,411 figure counts only the flaws released on Patch Tuesday itself. A further 348 had already been fixed earlier in October. About 70 of the total are rated Critical, most of them remote code execution flaws, the kind that can let an attacker run their own code on a system.
You do not need to read the individual advisories. What matters is the gap between "patch published" and "every machine in your office has it". Attackers watch for new fixes and start building attacks against businesses that are slow to update.
The zero-day under attack
One flaw was confirmed as actively exploited:
- CVE-2026-96951, a Windows Shell security feature bypass. It defeats Mark of the Web, the warning Windows attaches to files downloaded from the internet or arriving by email.
In plain terms, Mark of the Web is why Windows shows "this file came from the internet, are you sure?" before opening a risky download. A bypass means a malicious file can arrive without that warning. Microsoft has not said how it is being exploited, so assume it could be delivered the usual ways: email attachments, downloaded "invoices" and shared-file links.
Two other flaws were publicly disclosed before the fix, though not reported as exploited:
- CVE-2026-108398, a .NET Framework flaw that can allow a bypass of Windows Defender Application Control, a feature some businesses use to restrict which software may run.
- CVE-2026-92707, a denial-of-service flaw in a MessagePack library for .NET.
Some Windows versions just stopped getting updates
October's update is also the last one for Windows 11 version 24H2 Home and Pro, and for Windows 10 Enterprise LTSB 2016. Windows 11 23H2 Enterprise, Education and IoT Enterprise stop receiving security updates next month.
If any PC in your business is on one of those versions, it will keep working, but it will no longer receive security fixes. We cover that in more detail in our Windows 11 24H2 end of support guide.
A practical checklist for this week
- Confirm updates installed, not just downloaded. Many machines sit on "restart required" for days. The fix is not active until the restart happens.
- Check Windows versions. Find any PC still on 24H2 Home or Pro and plan an upgrade to a supported release.
- Don't forget servers. Servers are often patched on a different schedule, or not at all, and Active Directory and other server components were among the Critical fixes.
- Remind staff about downloads. Until everything is patched, treat unexpected attachments and download links with extra suspicion, even when they look routine.
- Ask who owns patching. If nobody can tell you when your computers were last updated, that is the real problem to fix.
Why a record-sized release is a management problem, not a panic
Patch volumes keep climbing. Our look at September's record Patch Tuesday made the same point: the answer is a reliable monthly process, not a scramble each time a number makes headlines.
A managed IT services provider handles this for you: testing updates, deploying them on a schedule, chasing the machines that miss them and reporting what is out of date. It is also one layer of a sensible IT security approach alongside backups, multi-factor authentication and email filtering.
Not sure where your business stands?
If you are not certain your computers and servers are fully patched, or you have machines on a Windows version that has just run out of updates, we are happy to take a look. We are a Perth-based team and have been looking after local businesses since 1997. Contact us or call (08) 9325 1196.