Microsoft fixes a record 1,400+ security flaws this month. Update Windows now
October's Patch Tuesday is the biggest ever and includes a Windows flaw that attackers are already using to bypass file safety warnings.
Microsoft’s monthly security update, known as Patch Tuesday, is usually big. This month it broke every record. The October 2026 release fixes more than 1,400 security vulnerabilities across Windows, Office and other Microsoft products. BleepingComputer counted 1,411 flaws, including three zero-days, meaning bugs that were known or exploited before a fix existed.
If you use Windows, the advice is simple: install this month’s updates as soon as possible.
The most urgent flaw
The bug security experts are most worried about is CVE-2026-96951, a flaw in Windows Shell that attackers are already exploiting.
Here is how the attack works in plain English. Windows normally marks files downloaded from the internet with something called Mark of the Web. That mark is what makes Windows show a warning, or open Office files in a safe “Protected View”, when a file comes from an untrusted place.
This flaw lets an attacker create a special file that skips those protections. If you open it, there is no warning and no safe mode. The file could arrive by email, in a chat app, through a collaboration tool or as a download. You still have to open the file yourself, which is why attackers use convincing messages to trick people.
It is the third Windows Shell flaw exploited in the wild this year. The US cybersecurity agency CISA has added it to its list of known exploited vulnerabilities, which requires federal agencies to patch quickly.
Other serious fixes
- 55 “wormable” flaws in DHCP Server, Remote Desktop Gateway and Network Policy Server. Wormable means malware could spread from computer to computer without anyone clicking anything. These mostly affect business servers.
- A critical SharePoint flaw (CVE-2026-102866) that could, in some configurations, let attackers take over user accounts.
Why so many bugs?
Experts point to AI. AI tools are now very good at finding security weaknesses in software, so companies like Microsoft are discovering and fixing far more bugs than before. That is good news in the long run, but it creates a heavy workload for IT teams, who must test and install huge updates every month.
A big number is not the scary part. The scary part is the one flaw attackers are already using.
What you should do
Home users:
- Open Settings → Windows Update and click Check for updates. Install everything and restart.
- Update Microsoft Office too. It usually updates with Windows, or through any Office app under Account → Update Options.
- Be extra careful with unexpected attachments and downloads, even from people you know.
Businesses and IT teams:
- Patch CVE-2026-96951 first, as it is being actively exploited.
- Prioritise the wormable server flaws next, especially on systems reachable from the internet.
- Rank fixes by real-world risk, not by the raw number of bugs.
