InfoSecBulletin Cybersecurity for mankind
Microsoft breaks its record to its patch history. The company patched record 1411 flaws and 3 zero day of its October 2026 Patch Tuesday. This Patch Tuesday addresses 70 “Critical” vulnerabilities, 57 of which are remote code execution, 11 are elevation of privileges, and 2 are spoofing.
The approximate number of bugs in each vulnerability category is listed below:
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
Multiple European supermarket fridges got hacked: Temperatures reached high as 55°C
Apple Warns 99 Countries iPhone Users of Mercenary Spyware Attacks
Daily Cyber security update for 31.10. 2026
677 Elevation of Privilege Vulnerabilities
40 Security Feature Bypass Vulnerabilities
317 Remote Code Execution Vulnerabilities
254 Information Disclosure Vulnerabilities
73 Denial of Service Vulnerabilities
28 Spoofing Vulnerabilities
Therefore, today’s total does not include 348 flaws fixed earlier this month. These include issues in Azure API Center, Azure App Service, Azure Event Grid, Azure SRE Agent, Mariner, Microsoft Bookings, Microsoft Dataverse, Microsoft Exchange Server, and Microsoft Partner Center.
This Microsoft Patch Tuesday sets a new record as Microsoft keeps using artificial intelligence to find and fix security problems in its products.
Microsoft said today that Windows 11, version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 are no longer supported.
“Today, October 13, 2026, Windows 11, version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 have reached end of updates. The October 2026 monthly security update is the last update available for these editions,” Microsoft said.
Microsoft said earlier this month that groups using Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions need to upgrade. They won’t get security updates starting next month.
To find out more about the non-security updates released today, you can check our articles on the Windows 11 KB5127648 & KB5126653 updates and the Windows 10 KB5126657 security update.
Microsoft patches 2 zero-days
This month’s Patch Tuesday fixes one zero-day vulnerability that is being used by attackers and two others that are known to the public.
Microsoft calls a zero-day flaw public or actively used when there is no official fix. The zero-day problems being used now that were fixed in October 2026 Patch Tuesday are:
CVE-2026-96951 – Windows Shell Security Feature Bypass Vulnerability
Microsoft fixed a security flaw that was being used by hackers. This flaw let them avoid the Mark of the Web security check.
“Improper neutralization of special elements used in a command (‘command injection’) in Windows Shell allows an unauthorized attacker to bypass a security feature over a network,” warns Microsoft.
No details have been shared on how attackers exploited the flaw or who disclosed it.
The two zero-days that were publicly disclosed are:
CVE-2026-108398 – .NET Framework Security Feature Bypass Vulnerability
Microsoft has fixed a security issue in the .NET Framework that let people run unauthorized programs.
“Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally,” explains Microsoft.
Microsoft says this flaw might let attackers get around Windows Defender Application Control (WDAC) rules and run apps that are not allowed.
“An authenticated attacker could place a specially crafted .NET assembly on an affected system and register it for loading by a protected process.” Microsoft says.
“Successful exploitation could bypass Windows Defender Application Control restrictions and allow the attacker to execute code within the protected process. User interaction is not required.”
James Forshaw of Google Project Zero discovered the flaw.
CVE-2026-92707 – MessagePack-CSharp Denial of Service Vulnerability
Microsoft fixed a denial-of-service flaw in MessagePack-CSharp.
“Improperly controlled sequential memory allocation in .NET allows an unauthorized attacker to deny service over a network,” explains Microsoft. Microsoft has not shared who disclosed the vulnerability.
