Microsoft released its October 2026 security updates on 13 October, a record release fixing more than 1,400 flaws. One Windows flaw is already being used by attackers, so these updates should be installed promptly.

• What it is: CVE-2026-96951, a Windows Shell flaw that lets a crafted file bypass the "Mark of the Web" warnings, including SmartScreen and Office Protected View.
• Who is affected: Windows users who open files received by email, chat or web download.
• The risk: An attacker only needs a staff member to open a booby-trapped file. The update also fixes five critical Outlook flaws, two of which can trigger simply by previewing an email.
• Also note: Windows 11 24H2 Home and Pro reached end of servicing on 13 October, so those devices need to move to a newer version.

We recommend that businesses deploy the October updates this week, starting with devices used for email and web browsing, and remind staff to be cautious with unexpected attachments.

Source: Help Net Security