Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days

Microsoft's October 2026 Patch Tuesday delivers fixes for a record 1,411 vulnerabilities, including 70 rated Critical (57 remote code execution, 11 elevation of privilege, 2 spoofing) and three zero-day issues. One zero-day, a command-injection flaw in Windows Shell that lets attackers bypass the Mark of the Web security feature, is confirmed to be actively exploited in the wild, though Microsoft has not disclosed attack details or who reported it. The other two zero-days are publicly disclosed but not yet exploited: a .NET Framework security-feature-bypass bug (found by Google Project Zero's James Forshaw) that can defeat Windows Defender Application Control and let a specially crafted assembly run inside a protected process without user interaction, and a denial-of-service flaw in MessagePack-CSharp tied to uncontrolled memory allocation in .NET. The release coincides with Microsoft ending support for Windows 11 24H2 Home/Pro and Windows 10 Enterprise LTSB 2016, making this their final security update, while Windows 11 23H2 Enterprise/Education/IoT editions lose updates starting next month.