Emily Long is a freelance author based in Salt Lake City.
After graduating from Duke University, she spent multiple years reporting on the national workforce for Government Executive, a publish of Atlantic Media Company, in Washington, D.C. She has nearly a decade of cognition as a freelancer covering tech (including issues connected to security, privacy, and streaming) as fine as individual backing and travel.
In supplement to Lifehacker, her activity has been featured on Wirecutter, Tom’s Guide, and ZDNET. Emily has additionally worked as a journey guide about the U.S. and as a satisfied editor. She has a masters in social activity and is a licensed therapist in Utah.
Microsoft's monthly Patch Tuesday bug figure has been trending higher since the commencement of the summer, and October is no different. The business fair issued fixes for a document 1,411 vulnerabilities, including three zero-days, which are flaws that have been actively exploited or publically disclosed before an authoritative place is available, making them particularly risky.
For comparison, in October 2025, Microsoft issued patches for fewer than 180 flaws—six of which were zero-days—which was considered a ample update at the time. Fixes typically numbered in the twice digits until the center of this year, whenever the totals jumped to 206 (June), 570 (July), 400 (August), and 966 (last month). That steep addition is mostly attributable to AI models, which are making it easier for bad actors to create hacking tools to utilize vulnerabilities, and for companies to discover and place these flaws additional quickly. This method that update cycles are being shortened and/or contain a considerably higher figure of fixes. Companies akin Microsoft are using AI to detect and location bugs, although AI isn't as fine at the latter, and may, in several cases, introduce additional vulnerabilities in the process.
October's Patch Tuesday fixes 1,411 flaws, including three zero-days
As BleepingComputer reports, the October 2026 safety update addresses flaws throughout the following categories: 677 elevation-of-privilege vulnerabilities, 40 safety characteristic bypass vulnerabilities, 317 remote-code-execution vulnerabilities, 254 data disclosure vulnerabilities, 28 spoofing vulnerabilities, and 73 denial-of-service vulnerabilities. 70 of the bugs are rated "critical" and contain distant code execution, height of privilege, and spoofing flaws. Microsoft patched an additional 348 bugs before this duration for assorted Azure, Mariner, and Microsoft products.
One of the zero-days patched this duration has been actively exploited in the wild. CVE-2026-96951 is a safety characteristic bypass exposure in Windows Shell that allows attackers unauthorized admission complete a network. Microsoft has not provided particulars on who disclosed this flaw or how it was exploited.
The another two zero-days were publically disclosed. CVE-2026-108398 is a safety characteristic bypass exposure in the .NET example that would authorize attackers to bypass Windows Defender Application Control restrictions and run unauthorized applications without person interaction. This flaw has been attributed to James Forshaw of Google Project Zero. Finally, CVE-2026-92707 is a denial-of-service exposure in MessagePack-CSharp credited to an anonymous source.
You should update your PC ASAP
PC users should justify that they download and instal all safety updates as shortly as they're available. Patch Tuesday typically releases on the second Tuesday of all duration about 10 a.m. PT and have to be applied automatically. However, stated the expanding risk, it's a fine idea to verify your machine's update position via Start > Settings > Windows Update > Check for Windows updates.
Emily Long is a freelance author based in Salt Lake City.
/s3/static.nrc.nl/wp-content/uploads/2026/10/14143445/141026ECO_2037464592_AI-1.jpg)
