Microsoft released its October 2026 security updates on Tuesday, October 13. The release fixes more than 1,400 vulnerabilities, which makes it the largest Patch Tuesday on record. BleepingComputer counted 1,411 flaws, and Tenable counted 1,407.
One of those flaws is already being used in real attacks. It is tracked as CVE-2026-96951, and it affects Windows Shell. Microsoft rates it Important with a CVSS score of 8.8. CVSS, the Common Vulnerability Scoring System, is the industry's standard 0-to-10 scale for how severe a security flaw is, and anything from 7.0 to 8.9 counts as high severity. The bug lets a booby-trapped file slip past a Windows safety feature called "Mark of the Web."
Mark of the Web is a hidden tag Windows quietly attaches to any file that comes from the internet, such as a download or an email attachment. That tag is the reason Windows asks before opening a downloaded file. It is also the reason Office opens email attachments in Protected View. Help Net Security reports that a malicious file can arrive by email, by chat, or through a collaboration tool like Teams. It can also come from a website that tricks someone into downloading it. Once the file is opened, those normal warnings may never appear.
The Cybersecurity and Infrastructure Security Agency (CISA), the federal agency that tracks cyber threats to U.S. networks, added the flaw to its Known Exploited Vulnerabilities catalog on October 13. Federal agencies have until October 16 to fix it. That deadline does not apply to private businesses, but it shows how seriously the government is treating this bug.
The fix is in the October cumulative update for Windows. The hard part is making sure that update actually finished on every machine. Updates often download and then wait for a restart that nobody takes. Laptops that stay closed at home can miss the update for weeks. A server that someone set to install updates manually may not have it at all.
Start by opening Settings, then Windows Update, then Update history on each PC. Look for a 2026-10 cumulative update with a status of successfully installed. If Windows says a restart is required, the fix is not active yet. On servers, check the same history or have your IT provider pull a patch report from its management tools. Any machine that cannot show the October update should be treated as unprotected.
Staff habits matter too. Until every device is confirmed, remind people not to open attachments or downloads they were not expecting, even from names they know.
This month also marks the end of updates for some older systems. Microsoft says Windows 11 version 24H2 Home and Pro editions received their final update this month. Windows Server 2012 and 2012 R2 also stopped receiving Extended Security Updates on October 13.
If your Brownsboro company is not sure every computer took the October update, My I.T. Consultants can find out with a Free Assessment. We will check each PC and server and work with you to address what still needs updates or protection. Hourly work is handled during our posted weekday hours, and contract customers are covered 24/7. To schedule your Free Assessment, call 903-675-5431.
