Microsoft's record October Patch Tuesday addressed 1,413 vulnerabilities including three zero-days, one an actively exploited Windows Shell remote code execution flaw added to CISA's Known Exploited Vulnerabilities catalogue — a command-injection security-feature bypass (CVE-2026-96951) that lets an unauthorised attacker defeat the Mark-of-the-Web check over the network. The other two zero-days were publicly disclosed: a .NET Framework untrusted-search-path bypass (CVE-2026-108398, found by James Forshaw of Google Project Zero) that can defeat Windows Defender Application Control and run unauthorised code within protected processes, and a MessagePack-CSharp denial-of-service flaw (CVE-2026-92707). Seventy of the fixed flaws are rated Critical, 57 of them remote code execution, and the record volume is partly attributed to the AI platforms Microsoft uses to find vulnerabilities. The release also marks end of support for Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016. Administrators should treat the Windows Shell flaw as actively targeted and apply the update ahead of routine patch cadence; the scale makes ASD patch-priority guidance the primary take-away for Australian estates.

• Source article