vendors/microsoft.htmlSecurity news, advisories and CVEs for MicrosoftMon, 19 Oct 2026 12:28:44 GMT https://www.infosecurity-magazine.com/news/connectwise-shuts-off-cloud/ekc08wMon, 19 Oct 2026 10:30:00 GMTInfosecurity Magazine. Cloud Backup, SaaS Security, and Cloud Management services offline as IT service provider investigates possibility that unknown attackers have full access to client environments via stolen tokens https://www.helpnetsecurity.com/2026/10/19/check-point-brand-impersonation-scams-q3-2026-report/yxl60qMon, 19 Oct 2026 09:38:17 GMTHelp Net Security. Microsoft accounted for 33% of brand impersonation attempts tracked by Check Point Research in the third quarter of 2026, up from 23% in the previous quarter and roughly four times the share of any other brand. Top 10 most impersonated brands in phishing…Phishing https://securityaffairs.com/201236/hacking/attackers-abuse-stolen-connectwise-application-credentials-to-target-microsoft-365.html1783pvrMon, 19 Oct 2026 09:32:56 GMTSecurity Affairs. Attackers stole ConnectWise application credentials to access Microsoft 365 tenants, prompting the company to suspend cloud services. ConnectWise suspended its Cloud Backup service and took both SaaS Security and Cloud Management offline over the weekend… https://news.google.com/rss/articles/CBMid0FVX3lxTE92bzZfT05QQjk1dmpuYUt1TDJxd3M4d1prOUlBemxZd25vRlphMHljb3BlWDE0RkwwMFpZQnB4QXNCczdxbzdudXpVSE43c0ZwRWV6N0t3LXhYbURhcUw4TFl3UmZ1Z3FjQVlSQ3pCeldZMWZ3eTNz0gF8QVVfeXFMT3pRUTY1aDBJZ0RwR0dPejVOaTBoN1dfNkJkSXJrZFhTLVJDSEVZU0VzRWRkR1pua0RSZ0VHZ1FENWZjT3djTGRjdFpBWGRka1RSODlfUXQ4anUyVTdFOHY4MkU1cEJoYzRsUWp5Nmc5d1A3eHJuMDhVeVdoYw?oc=5oa1m2oMon, 19 Oct 2026 04:28:04 GMTCybersecurity News. Microsoft Confirms October Windows Updates Can Break Exchange Server Email Services CyberSecurityNews https://cybersecuritynews.com/october-updates-break-exchange-server/1q56t5gMon, 19 Oct 2026 03:39:03 GMTCybersecurity News (+1 more sources). Microsoft has confirmed that Windows Server security updates released on October 13, 2026, can disrupt Exchange Server email services, blocking webmail access and leaving messages undelivered. The issue affects some on-premises systems running Exchange Server…Vulnerability https://decipher.sc/2026/10/18/ongoing-microsoft-365-campaign-abuses-connectwise-app/122pc42Sun, 18 Oct 2026 15:59:29 GMTDecipher. Threat actors have compromised a credential within the vendor’s infrastructure, allowing them to abuse a client assertion that bypasses traditional user authentication. https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html1ivpl15Sun, 18 Oct 2026 08:23:02 GMTThe Hacker News. ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365… https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/ye28rtSat, 17 Oct 2026 15:18:51 GMTBleepingComputer. ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. [...]BreachSupply chain https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html1subncrSat, 17 Oct 2026 11:11:56 GMTThe Hacker News. Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user…MalwareSupply chain https://news.google.com/rss/articles/CBMigwFBVV95cUxOdjBNbGZBM3lMQXRDeTZOcFc4cVFZenVRZUpiWUpMSW1jaEhZV2s5emRvbm9GdGNYbjIxOHRFMXhDbTZzVjBLaGlIN0hpS0RFSURDdkU3UENDblhqN0JWY0FXc1BmblNjQlJBVXVIZjMxS3lLWVhWQ2hxc0oxNEw4TE9Rb9IBiAFBVV95cUxOd3JZcTlEMjF6THlwWU55M2RWSGxObktWY2RlRVVLSFJHc0pBR25mVUVjWVRxeDNhOHF0aUkzTFpzaVFKUlZiNzB5c0huZHVTMkVQQ3FPa3hTVmMxYUlIZEhTdWNaNkVicm9WNWVwbTlydHZsUGFLd2M1SVVHS3VCeWRnMlNuZnVs?oc=51i8dbkfSat, 17 Oct 2026 10:59:30 GMTCybersecurity News. Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts CyberSecurityNews https://cybersecuritynews.com/connectwise-credentials-microsoft-365-accounts/2gqfplSat, 17 Oct 2026 10:52:09 GMTCybersecurity News. Hackers used a stolen ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 partner and customer tenants, giving them access through a trusted backup application. The incident shows how one leaked vendor secret can create risk across many… https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html8616k0Sat, 17 Oct 2026 06:16:46 GMTThe Hacker News. Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to… https://www.theregister.com/security/2026/10/16/networking-problems-after-the-october-2026-windows-update-ntlm-might-be-to-blame/5303503ar65kfFri, 16 Oct 2026 15:30:00 GMTThe Register. Legacy protocol is going to be axed, and enforcement by default will highlight how migration is going https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105008bwfj2eFri, 16 Oct 2026 14:00:00 GMTMicrosoft Security Update Guide. CWE added. Informational change only.AdvisoryVulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96044e046qnFri, 16 Oct 2026 14:00:00 GMTMicrosoft Security Update Guide. CWE added. Informational change only.AdvisoryVulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-1084711xy0p9fFri, 16 Oct 2026 14:00:00 GMTMicrosoft Security Update Guide. CWE added. Informational change only.AdvisoryVulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-10846514wmc2Fri, 16 Oct 2026 14:00:00 GMTMicrosoft Security Update Guide. Updated an acknowledgement. This is an informational change only.AdvisoryVulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83831loe5e9Fri, 16 Oct 2026 14:00:00 GMTMicrosoft Security Update Guide. Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.AdvisoryVulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8589015zig02Fri, 16 Oct 2026 14:00:00 GMTMicrosoft Security Update Guide. Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.AdvisoryVulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8589714lkfj7Fri, 16 Oct 2026 14:00:00 GMTMicrosoft Security Update Guide. Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.AdvisoryVulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85898187f9juFri, 16 Oct 2026 14:00:00 GMTMicrosoft Security Update Guide. Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.AdvisoryVulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96198ntimutFri, 16 Oct 2026 14:00:00 GMTMicrosoft Security Update Guide. Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.AdvisoryVulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96199njj15uFri, 16 Oct 2026 14:00:00 GMTMicrosoft Security Update Guide. Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.AdvisoryVulnerability https://cybersecuritynews.com/cloudflare-pages-domains/gwd5arFri, 16 Oct 2026 12:43:37 GMTCybersecurity News. Hackers have abused more than 20,000 Cloudflare Pages domains over six months to spread fake Microsoft security alerts and steer users toward scam call centers. The campaign uses Help Traffic Distribution System, or Help TDS, to route visitors from… https://www.bleepingcomputer.com/news/microsoft/kb5127648-windows-security-update-may-break-smart-app-control/1d5llukFri, 16 Oct 2026 08:44:22 GMTBleepingComputer. Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update. [...]Vulnerability https://www.securityweek.com/microsoft-patches-two-dozen-rce-flaws-in-office/15ih6daFri, 16 Oct 2026 07:55:06 GMTSecurityWeek. In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in Office.Vulnerability https://cybersecuritynews.com/kgb-rat-malware/dlsthzThu, 15 Oct 2026 12:52:34 GMTCybersecurity News. A Windows remote access trojan called KGB RAT gives attackers a way to spy on infected computers, collect credentials and control a victim’s desktop. The malware is sold as a service and advertised with a “fully undetectable” crypter that its sellers claim…Malware https://cybersecuritynews.com/microsoft-fixes-windows-11-update-issue/1kufu8yThu, 15 Oct 2026 10:44:33 GMTCybersecurity News. Microsoft fixed a Windows 11 update issue that could leave users staring at a black screen after signing in or cause Windows Explorer to crash. The problem mainly affected Azure Virtual Desktop hosts using FSLogix, and some existing user profiles were more… https://cybersecuritynews.com/microsoft-windows-server-0-day-flaw/1lwibd4Thu, 15 Oct 2026 09:58:35 GMTCybersecurity News. Microsoft patched a Windows Server vulnerability that lets a network-adjacent attacker crash a server with a crafted Distributed File System (DFS) referral response. Tracked as CVE-2026-70111, the flaw affects Windows Server 2019, 2022, and 2025. Corelight…VulnerabilityZero-day https://aws.amazon.com/security/security-bulletins/rss/2026-135-aws/1sl01u4Wed, 14 Oct 2026 19:48:49 GMTAWS Security Bulletins. Bulletin ID: 2026-135-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/14/2026 12:30 PM PDT Description: We identified CVE-2026-110310, an issue in Amazon S3 encryption client for .NET that could allow a remote user who can…AdvisoryVulnerability https://aws.amazon.com/security/security-bulletins/rss/2026-024-aws/1um6ntlWed, 14 Oct 2026 18:37:57 GMTAWS Security Bulletins. AdvisoryVulnerability https://cyberscoop.com/microsoft-patch-tuesday-october-2026/1vpgiwvWed, 14 Oct 2026 17:42:11 GMTCyberScoop. In its October Patch Tuesday, the tech giant addressed more defects in one month than any annual total on record. Nearly 4 in 5 vulnerabilities affect Windows.VulnerabilityZero-day https://www.huntress.com/blog/microsoft-vss-limits-and-best-practiceso7fc00Wed, 14 Oct 2026 16:00:00 GMTHuntress. Microsoft VSS remains a cornerstone of Windows data protection, but its architectural limits matter. Learn when to rely on it and when to go beyond it.Research https://security.paloaltonetworks.com/CVE-2026-03141jsk9puWed, 14 Oct 2026 16:00:00 GMTPalo Alto Networks Advisories. AdvisoryVulnerability https://cybersecuritynews.com/microsoft-recent-update-remote-desktop/2rhunzWed, 14 Oct 2026 15:51:38 GMTCybersecurity News. Microsoft has confirmed a Windows 11 Remote Desktop issue that can prevent non-admin users from connecting to remote computers with Administrator protection enabled. The problem follows the September 22, 2026, non-security preview update, KB5124010, or later… https://news.google.com/rss/articles/CBMieEFVX3lxTE91TnlDSEkxaGJGX0VBTFo3d29ablNlRENxU21xMEpNVEpCcFBMRXdxRjVqYmNQM0xfQ0w5dzNPZ3N4NmZRd2hfZlpDYW1KQ2tXYTFWQ2VtUDNJLXBKUWFXTmdXNjFLY0F0cEM4YlhlS1Vfb2tZbzNBZ9IBfkFVX3lxTFBpM004T2ctQmFfZ2cySUlRMXlZLXN3LWxlamh6TEFyYjA4SWlWNEhmYjMxY3JZTWFEX2dWZlF0blFxbG5sU2l6Yy1fNW5Zemo5WEVZSWNJeGYzOTdGTV94SXBGYXdPaXk5TkJDTTB0cHpGVFVqTFBUbnZHSC1sdw?oc=5k9uv03Wed, 14 Oct 2026 15:51:38 GMTCybersecurity News. Microsoft’s Recent Windows Updates Break Remote Desktop Services With Error "0xC000000D" CyberSecurityNews https://www.cybersecuritydive.com/news/phishing-marketplace-takedown-microsoft-health-isac/832965/18uop5zWed, 14 Oct 2026 14:40:14 GMTCybersecurity Dive. The three marketplaces helped hackers impersonate major businesses and governments. Microsoft now controls the markets’ domain names.Phishing https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-vpn-issues-caused-by-september-windows-updates/1f9ogk2Wed, 14 Oct 2026 14:27:01 GMTBleepingComputer. Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates. [...]Vulnerability https://cybersecuritynews.com/west-african-scam-networks/znmp62Wed, 14 Oct 2026 13:44:57 GMTCybersecurity News. Meta, Google, Microsoft and OpenAI joined an international crackdown on West African scam networks that removed more than 3.7 million Facebook and Instagram accounts, pages and groups. Announced on October 13, 2026, the operation led to 28 arrests and the… https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms1ct070wWed, 14 Oct 2026 13:18:00 GMTThe Record. The tech giant worked with Japan’s National Police Agency and healthcare cybersecurity organization Health-ISAC to obtain a U.S. court order seizing and redirecting domains that were part of the infrastructure underlying YAM Store, CoGUI and Iron Man.Phishing https://www.bleepingcomputer.com/news/security/global-takedown-hits-network-behind-1-billion-phishing-messages/l74trlWed, 14 Oct 2026 13:12:52 GMTBleepingComputer (+5 more sources). A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. [...]PhishingLaw & policyAPT https://www.securityweek.com/microsoft-disrupts-chinese-language-phishing-market-behind-1b-messages/11sugfzWed, 14 Oct 2026 13:00:00 GMTSecurityWeek. Backed by a federal court order, Microsoft and Health-ISAC seized domains powering YAM Store, CoGUI, and Iron Man.Phishing https://cyberscoop.com/microsoft-disrupts-chinese-language-phishing-kit-ecosystem/1lno709Wed, 14 Oct 2026 13:00:00 GMTCyberScoop. In less than 10 months, cybercriminals used the arsenal of customized, targeted phishing kits to send more than 1 billion malicious messages to more than 75,000 organizations globally.Phishing https://www.malwarebytes.com/blog/bugs/2026/10/update-windows-record-patch-tuesday-fixes-flaw-already-under-attackk3wde7Wed, 14 Oct 2026 11:26:09 GMTMalwarebytes Labs. Microsoft’s October updates address a record 1,413 vulnerabilities, including a Windows flaw attackers are already exploiting and two other zero-days.ResearchVulnerabilityZero-day https://www.bleepingcomputer.com/news/security/microsoft-recent-windows-updates-may-trigger-remote-desktop-failures/1pt6299Wed, 14 Oct 2026 10:48:09 GMTBleepingComputer. Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled. [...] https://news.google.com/rss/articles/CBMigAFBVV95cUxOU29fbGd3TnV4Q04zMGxPSzQ1WmNOd3BZWkhQanFhZlZNRnFMdE4wblJUd3B3OVZvX05Vd2dGY2lWSVN2a3V2YkxSZS1kd1MzSEZjY1NOaGFIbEF5Zk1zU25JZjk5UW1pQjlFUW5ocnl6dkthb0FvLTg3RHVwWVJlUdIBhgFBVV95cUxNdGlQX1duS2JlSnJJVlc4NHZjWFBoTi1UZkFqMTgtekhyRlB2U1pmb3ZrSWIwU1gxM1ZQNndIYjlJMmJ3aGYxQ0V5bk9laFFPUzlSdHBwYmhIWkFyVUR4SmlaZExQM21CTlItTFJqbjFFUzdnTUNrUUNDam5rZUZLUnloaVEyUQ?oc=5j95y41Wed, 14 Oct 2026 09:32:02 GMTCybersecurity News. Windows SmartScreen Vulnerability Enables Privilege Escalation Attacks CyberSecurityNewsVulnerability https://cybersecuritynews.com/windows-smartscreen-escalation-vulnerability/1pcpnovWed, 14 Oct 2026 09:28:05 GMTCybersecurity News. Microsoft has released fixes for a Windows SmartScreen vulnerability that allows an attacker with local access to gain higher privileges. Tracked as CVE-2026-85851, the flaw was disclosed on October 13, 2026, and carries a CVSS base score of 7.8. Microsoft…Vulnerability https://www.infosecurity-magazine.com/news/microsoft-patch-tuesday-record-1/2gyb3vWed, 14 Oct 2026 08:45:00 GMTInfosecurity Magazine. Microsoft issued its largest ever round of security updates in the October Patch TuesdayVulnerability https://cybersecuritynews.com/windows-bitlocker-bypass-vulnerabilities/aenjssWed, 14 Oct 2026 07:03:08 GMTCybersecurity News. Microsoft fixed three Windows BitLocker vulnerabilities CVE-2026-85920, CVE-2026-88070, and CVE-2026-83500 that could enable privilege escalation or bypass security protections in its October 2026 updates. BitLocker is a core Windows disk-encryption feature…Vulnerability https://thehackernews.com/2026/10/four-byte-write-and-timing-bug-let.html192shimWed, 14 Oct 2026 05:52:28 GMTThe Hacker News. Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. The protected area is a VBS enclave, an isolated slice of memory the operating system uses to guard…Vulnerability https://news.google.com/rss/articles/CBMibEFVX3lxTE1xdUd6ZVVGUkJrNkJSczBNdXFUakI4cElOM1UxdHNyS1VZRjBiNEFTUzludFBDa1VTZW9SOV8tbEEwdktSUGY1alEzVU1wNGY0VWJNeWhLaDhLbzVkTDlqeWRkMVdPWFJudk9tZdIBckFVX3lxTE11Y1FCSDhkcXNTbjdxM2ozWG5TU0hHc3FqTl9lbXlnbEFHSlk1YTlCbHQ5VlBoSEdPUURUVm44b1pIeENUMy11aHFSRkRlblBNNTRCbWFiYlA3cmhCVldlT0QwTUhJNXIzZjRXa3dBVUFYdw?oc=5wuel0mWed, 14 Oct 2026 04:27:01 GMTCybersecurity News. Microsoft Windows Shell 0-Day Vulnerability Actively Exploited in Attacks CyberSecurityNewsVulnerabilityZero-day https://cybersecuritynews.com/windows-shell-0-day-exploited/nyg2b4Wed, 14 Oct 2026 03:28:11 GMTCybersecurity News (+4 more sources). Microsoft has patched an actively exploited Windows Shell zero-day vulnerability that allows attackers to bypass Mark of the Web protections. Tracked as CVE-2026-96951, the flaw was addressed in the October 2026 Patch Tuesday updates. It carries a CVSS score…VulnerabilityZero-day https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws/k0a8eiTue, 13 Oct 2026 23:24:53 GMTKrebs on Security. Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today's epic patch batch dwarfs September's record of nearly 1,000 fixes, which was already about ten times the normal monthly…Vulnerability https://blog.qualys.com/vulnerabilities-threat-research/2026/10/13/microsoft-patch-tuesday-october-2026-security-update-review70ydhjTue, 13 Oct 2026 21:32:08 GMTQualys Threat Research (+2 more sources). Microsoft has released its October 2026 Patch Tuesday security updates, addressing vulnerabilities across its products and services. As organizations continue to navigate an evolving threat landscape, applying security patches promptly remains critical to…AdvisoryVulnerabilityResearch https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-kb5126657-extended-security-update/3m7gyzTue, 13 Oct 2026 19:47:30 GMTBleepingComputer. Microsoft released the Windows 10 KB5126657 extended security update, which includes this month's record-breaking October 2026 Patch Tuesday fixes and a few bug fixes and changes. [...]Vulnerability https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-11-24h2-home-and-pro-reached-end-of-support/16louskTue, 13 Oct 2026 19:04:38 GMTBleepingComputer. Microsoft announced today that devices running Windows 11 24H2 Home and Pro editions have reached the end of support and will no longer receive monthly security and non-security preview updates. [...] https://cybersecuritynews.com/microsoft-october-patch-tuesday-2026/1p52350Tue, 13 Oct 2026 18:19:38 GMTCybersecurity News. Microsoft’s October 2026 Patch Tuesday briefing outlines 1,118 vulnerabilities across 15 risk groups, alongside a new approach designed to help security teams review large update releases. Called risk cohorts, these groups bring together flaws that require…Vulnerability https://news.google.com/rss/articles/CBMidkFVX3lxTFBMMTF3SDJTQlpPQmVMQnpOTHFqTHczeml3aGNLUGR4MVpZbXJ3ZFF2elFmVnpMSUdsY0o2OEgzYWR4bzFLclZ2bklFdzY0N3pWNEdMV0pQRDFsVUFoQmNmbVByRjJCZUx4SHE1QXVaQnNsRElYcVHSAXtBVV95cUxPWGUyUzRiUVB0Ni0zUjhYZnI4b3dsSUtkMTdhMGtGbWJWaFhXWlR5Q0dpM29Lc1N6NUNRWTNRV0ZCOWQweWdib05XLXcyU09TTEpOOWgxa0w5ZVoxMHFnSmFJREVlN2VzSkZwV1ZPQ3ZaczhqVUJVcm9XTFU?oc=58a9ynvTue, 13 Oct 2026 18:19:38 GMTCybersecurity News. Microsoft Fixes 1,118 Vulnerabilities in October Patch Tuesday and Introduces New Risk Cohorts CyberSecurityNewsVulnerability https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5127648-and-kb5126653-cumulative-updates-released/1026bh3Tue, 13 Oct 2026 17:49:38 GMTBleepingComputer. Microsoft has released the Patch Tuesday Windows 11 KB5127648 and KB5126653 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs, and add new features. [...]Vulnerability https://www.threathunter.ai/blog/october-2026-patch-tuesday-1411-fixes/b3v197Tue, 13 Oct 2026 00:00:00 GMTThreatHunter.ai (+9 more sources). The largest Patch Tuesday in 23 years. One zero-day being exploited right now, two more disclosed, 70 Critical bugs, and a twelve-month curve that says this is the new normal. Here is what to patch first, what we are hunting for, and the detection pack to go…ResearchVulnerabilityZero-dayAdvisory