Microsoft shipped October's Patch Tuesday on October 13 with roughly 1,410 fixes, around 1,102 of them in Windows. We have covered record-breaking patch volumes twice this year and the number is no longer the interesting part. What is worth five minutes is a single flaw in that pile, CVE-2026-96951, which is confirmed to be under active exploitation and which breaks something your staff rely on without knowing its name.
The flaw that matters
CVE-2026-96951 is a Windows Shell security feature bypass. The feature it bypasses is Mark of the Web, the invisible tag Windows attaches to any file that arrives from the internet or an email attachment. That tag is why you see the warning banner when you open a downloaded document, why macros stay disabled until you click to enable them, and why Windows asks whether you are sure before running an installer you fetched from a web page.
Strip the tag and a file downloaded from a phishing link behaves like a file that has always lived on your computer. No banner, no protected view, no friction. For a small business this matters more than the raw severity rating suggests, because that warning banner is doing a lot of quiet work. It is the moment where a user who was about to open something they should not pauses. Remove it and your last line of defence is whether the person was already suspicious.
About that number
Worth noting, because it says something about how to treat security reporting. The sources genuinely disagree on the count: Tenable says 1,407, BleepingComputer and GBHackers say 1,411, Microsoft's release notes cite 1,413 and the product breakdown totals 1,414. Critical counts range from 69 to 80 depending on who is tallying. The vendors are not being careless, they are counting slightly different things.
The practical conclusion is that the headline figure is close to meaningless for deciding what to do. Nobody triages 1,400 items. What you need to know each month is narrower: is anything being exploited right now, and does it affect software we run. This month the answer is yes and almost certainly yes. Two more flaws were publicly disclosed before patches shipped, with no confirmed exploitation.
What to actually do
- Make sure October's updates install this week, on every machine, including the laptop of whoever travels and the one in the back office that nobody uses.
- Check that updates are actually applying, not just enabled. A machine that has deferred updates for three months looks identically healthy from the outside.
- Remind people what the warning banner means while this is current. If a downloaded document opens with no warning at all, that is now a reason for mild suspicion rather than relief.
- Reinforce the habit that does not depend on the banner: unexpected attachment, unexpected sender, or an unexpected request inside a familiar-looking document means stop and verify.
- Confirm your Windows versions are still supported. Patches only help the versions still receiving them, and October 13 is also the date Windows 11 version 24H2 stops getting updates on Home and Pro, as we covered in the deadline post last week.
The takeaway
A thousand-plus patches is a headline, not a plan. The useful monthly question is whether anything in the pile is already being used against people, and this month one thing is: a flaw that quietly removes the warning your team depends on to tell a downloaded file from a safe one. Install the updates, and in the meantime treat the absence of a warning as no evidence of safety.