Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.advocacy > #149414 > unrolled thread

Microsoft patches 1,411 flaws and 3 0-days to make room for more

Back to article view | Back to comp.sys.mac.advocacy

Contents

  Microsoft patches 1,411 flaws and 3 0-days to make room for more CrudeSausage <crude@sausa.ge> - 2026-10-13 20:34 -0400
    Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more "Alan K." <alan@invalid.com> - 2026-10-13 21:09 -0400
      Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Paul <nospam@needed.invalid> - 2026-10-13 23:29 -0400
      Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Tom Elam <thomas.e.elam@gmail.com> - 2026-10-14 11:27 -0400
      Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more CrudeSausage <crude@sausa.ge> - 2026-10-14 11:50 -0400
        Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Tom Elam <thomas.e.elam@gmail.com> - 2026-10-14 18:30 -0400
        Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Paul <nospam@needed.invalid> - 2026-10-14 20:02 -0400
        Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more "Carlos E.R." <robin_listas@es.invalid> - 2026-10-15 21:42 +0200
          Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more CrudeSausage <crude@sausa.ge> - 2026-10-15 17:30 -0400
            Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more "Joel W. Crump" <joelcrump@gmail.com> - 2026-10-15 17:39 -0400
              Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-10-15 15:46 -0700
              Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more CrudeSausage <crude@sausa.ge> - 2026-10-15 20:07 -0400
                Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more "Joel W. Crump" <joelcrump@gmail.com> - 2026-10-15 20:30 -0400
                  Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Maria Sophia <mariasophia@comprehension.com> - 2026-10-15 18:42 -0700
                    Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more John Bokma <contact@johnbokma.com> - 2026-10-17 19:55 +0200
              Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more "Carlos E.R." <robin_listas@es.invalid> - 2026-10-17 19:49 +0200
    Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Nick Charles <none@none.none> - 2026-10-16 01:26 +0000
      Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more "Joel W. Crump" <joelcrump@gmail.com> - 2026-10-15 21:27 -0400
        Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Maria Sophia <mariasophia@comprehension.com> - 2026-10-15 19:07 -0700
        Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Nick Charles <none@none.none> - 2026-10-16 02:36 +0000
          Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Maria Sophia <mariasophia@comprehension.com> - 2026-10-15 19:50 -0700
          Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more "Joel W. Crump" <joelcrump@gmail.com> - 2026-10-15 23:06 -0400
          Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Paul <nospam@needed.invalid> - 2026-10-16 06:47 -0400
            Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Maria Sophia <mariasophia@comprehension.com> - 2026-10-16 09:33 -0700
              Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Paul <nospam@needed.invalid> - 2026-10-16 15:37 -0400
                Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Maria Sophia <mariasophia@comprehension.com> - 2026-10-16 21:49 -0400
        Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more CrudeSausage <crude@sausa.ge> - 2026-10-16 08:06 -0400
          Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Truth in Writing <OnlyTruthMatters@is.invalid> - 2026-10-16 16:38 +0000
            Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more CrudeSausage <crude@sausa.ge> - 2026-10-16 13:02 -0400
      Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more CrudeSausage <crude@sausa.ge> - 2026-10-16 08:04 -0400
        Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Paul <nospam@needed.invalid> - 2026-10-16 10:01 -0400

Page 1 of 2  [1] 2  Next page →

#149414 — Microsoft patches 1,411 flaws and 3 0-days to make room for more

<https://shorturl.at/nFg3w>

Today is Microsoft's October 2026 Patch Tuesday, with security updates 
addressing a record-breaking 1,411 flaws, including one actively 
exploited and two publicly disclosed zero-day vulnerabilities.

This Patch Tuesday addresses 70 "Critical" vulnerabilities, 57 of which 
are remote code execution, 11 are elevation of privileges, and 2 are 
spoofing.

The approximate number of bugs in each vulnerability category is listed 
below:

677 Elevation of Privilege Vulnerabilities
40 Security Feature Bypass Vulnerabilities
317 Remote Code Execution Vulnerabilities
254 Information Disclosure Vulnerabilities
73 Denial of Service Vulnerabilities
28 Spoofing Vulnerabilities
When BleepingComputer reports on Patch Tuesday security updates, we only 
count vulnerabilities released by Microsoft on Patch Tuesday itself.

Therefore, today's total excludes 348 flaws fixed earlier this month, 
including vulnerabilities in Azure API Center, Azure App Service, Azure 
Event Grid, Azure SRE Agent, Mariner, Microsoft Bookings, Microsoft 
Dataverse, Microsoft Exchange Server, and Microsoft Partner Center.

This is a record-breaking Microsoft Patch Tuesday as Microsoft continues 
to use artificial intelligence platforms to find and remediate security 
vulnerabilities in its products.

Microsoft announced today that Windows 11, version 24H2 Home and Pro, 
and Windows 10 Enterprise LTSB 2016 have reached end of support.

"Today, October 13, 2026, Windows 11, version 24H2 Home and Pro, and 
Windows 10 Enterprise LTSB 2016 have reached end of updates. The October 
2026 monthly security update is the last update available for these 
editions," Microsoft said.

Earlier this month, Microsoft also said organizations running Windows 11 
23H2 Enterprise, Education, and IoT Enterprise editions should upgrade 
to newer versions as they will no longer receive security updates 
starting next month.

To learn more about the non-security updates released today, you can 
review our dedicated articles on the Windows 11 KB5127648 & KB5126653 
cumulative updates and the Windows 10 KB5126657 extended security update.

Microsoft patches 2 zero-days
This month's Patch Tuesday fixes one actively exploited and two publicly 
disclosed zero-day vulnerabilities.

Microsoft classifies a zero-day flaw as publicly disclosed or actively 
exploited when no official fix is available.

The actively exploited zero-day vulnerabilities addressed during this 
October 2026 Patch Tuesday are:

CVE-2026-96951 - Windows Shell Security Feature Bypass Vulnerability

Microsoft patched an actively exploited zero-day security bypass flaw 
that allowed attackers to bypass the Mark of the Web security feature.

"Improper neutralization of special elements used in a command ('command 
injection') in Windows Shell allows an unauthorized attacker to bypass a 
security feature over a network," warns Microsoft.

No details have been shared on how attackers exploited the flaw or who 
disclosed it.

The two zero-days that were publicly disclosed are:

CVE-2026-108398 - .NET Framework Security Feature Bypass Vulnerability

Microsoft has fixed a security feature bypass in the .NET Framework that 
can be exploited to run unauthorized applications.

"Untrusted search path in .NET Framework allows an authorized attacker 
to bypass a security feature locally," explains Microsoft.

Microsoft says this flaw could allow attackers to bypass Windows 
Defender Application Control (WDAC) enforcement and run unauthorized 
applications.

"An authenticated attacker could place a specially crafted .NET assembly 
on an affected system and register it for loading by a protected 
process." Microsoft says.

"Successful exploitation could bypass Windows Defender Application 
Control restrictions and allow the attacker to execute code within the 
protected process. User interaction is not required."

James Forshaw of Google Project Zero discovered the flaw.

CVE-2026-92707 - MessagePack-CSharp Denial of Service Vulnerability

Microsoft fixed a denial-of-service flaw in MessagePack-CSharp.

"Improperly controlled sequential memory allocation in .NET allows an 
unauthorized attacker to deny service over a network," explains Microsoft.

Microsoft has not shared who disclosed the vulnerability.

Recent updates from other companies
Other vendors who released updates or advisories in October 2026 include:

Adobe released security updates for numerous products, including 
Commerce, Substance 3D Samples, ColdFusion, Photoshop, Dimension, and 
Framework.
Atlassian released security updates for a critical vulnerability 
(CVE-2026-21589) in multiple self-hosted Data Center products, including 
Confluence, Jira, and Bitbucket. Attackers soon exploited the flaw after 
a PoC was released.
Cisco released security updates for numerous products, including 
critical vulnerabilities in its NX-OS data center network operating 
system that can let attackers run arbitrary code with root privileges on 
Nexus switches.
Citrix released security updates for NetScaler ADC and NetScaler Gateway 
flaws, with CVE-2026-88779 exploited in zero-day attacks before it was 
patched.
Dell released security updates for critical vulnerabilities in the 
System Update (DSU) command-line interface (CLI) deployment tool and 
Container Storage Modules (CSM).
Docker patched a critical flaw in DockerHub that lets attackers 
impersonate users and push images from others' repositories.
Fortinet released security updates for numerous products, including a 
critical FortiMail vulnerability (CVE-2026-104286) that attackers 
exploited in zero-day attacks.
GitLab released security updates for critical flaws in AI Gateway and 
CI/CD Regular Expression Compiler.
Ivanti released security updates for an actively exploited zero-day 
vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.
Kiteworks released security updates for 126 vulnerabilities, including a 
max-severity flaw affecting its Email Protection Gateway (EPG) security 
solution.
Progress Software released security updates for critical and high 
security vulnerabilities in MarkLogic Server.
SAP released the October security updates, addressing 20 security flaws, 
including a maximum-severity OAuth2 SSRF vulnerability in Cloud SDK for 
Python.
SonicWall released security updates for a critical SMA1000 server-side 
request forgery (SSRF) flaw, which attackers exploited within two days.
New risk cohorts help prioritize security updates
With this month's record-breaking number of vulnerabilities, Microsoft 
has also introduced a new method for organizations to prioritize 
security updates by grouping related flaws into what it calls "risk 
cohorts."

The new approach groups similar vulnerabilities together to help 
organizations better understand which security flaws pose the greatest 
risk to their systems and should be prioritized for patching.

For October 2026, Microsoft published 15 risk cohorts, including:

136 vulnerabilities affecting Windows filesystems, storage, and backup.

135 vulnerabilities involving Office documents and mail clients.

131 vulnerabilities affecting Windows graphics, media, and content 
processing.

109 vulnerabilities involving Windows core and kernel privilege boundaries.

103 vulnerabilities affecting Windows installation, deployment, and 
update services.

Microsoft stressed that these groups do not necessarily indicate which 
flaws are the most dangerous, as the actual risk depends on whether they 
are being exploited in attacks, their severity, and how an organization 
uses the affected software.

Microsoft says the new approach is still experimental and is meant to 
help organizations prioritize security updates, not replace its existing 
patching recommendations.

Microsoft has published a PDF mapping the October 2026 vulnerabilities 
to their respective risk cohorts.


-- 
CrudeSausage
MacBook Air M4
iPhone 13
Friendly Apple zealot

[toc] | [next] | [standalone]

#149415

On 10/13/26 8:34 PM, CrudeSausage wrote:
> <https://shorturl.at/nFg3w>
> 
> Today is Microsoft's October 2026 Patch Tuesday, with security updates
> addressing a record-breaking 1,411 flaws, including one actively
> exploited and two publicly disclosed zero-day vulnerabilities.
> 

> 
Could a link to that article have saved the time and effort?   I'd like to think so.

-- 
Mint 22.3,  Thunderbird 153.4.0esr,  Firefox 157.0.1
     Alan K.

[toc] | [prev] | [next] | [standalone]

#149417

On Tue, 10/13/2026 9:09 PM, Alan K. wrote:
> On 10/13/26 8:34 PM, CrudeSausage wrote:
>> <https://shorturl.at/nFg3w>
>>
>> Today is Microsoft's October 2026 Patch Tuesday, with security updates
>> addressing a record-breaking 1,411 flaws, including one actively
>> exploited and two publicly disclosed zero-day vulnerabilities.
>>
> 
>>
> Could a link to that article have saved the time and effort?   I'd like to think so.
> 

   "Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days"

    https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/

       By Lawrence Abrams   October 13, 2026

Amazing. Even the deck chairs have changed colors.

[toc] | [prev] | [next] | [standalone]

#149424

On 10/13/26 9:09 PM, Alan K. wrote:
> On 10/13/26 8:34 PM, CrudeSausage wrote:
>> <https://shorturl.at/nFg3w>
>>
>> Today is Microsoft's October 2026 Patch Tuesday, with security updates
>> addressing a record-breaking 1,411 flaws, including one actively
>> exploited and two publicly disclosed zero-day vulnerabilities.
>>
> 
>>
> Could a link to that article have saved the time and effort?   I'd like 
> to think so.
> 
I realize that copy/paste is a major time and effort issue for you, but 
it is really pretty quick and easy for most of us. If the link ever goes 
away the content is now here for all to see.

[toc] | [prev] | [next] | [standalone]

#149425

On 2026-10-13 9:09 p.m., Alan K. wrote:
> On 10/13/26 8:34 PM, CrudeSausage wrote:
>> <https://shorturl.at/nFg3w>
>>
>> Today is Microsoft's October 2026 Patch Tuesday, with security updates
>> addressing a record-breaking 1,411 flaws, including one actively
>> exploited and two publicly disclosed zero-day vulnerabilities.
>>
> 
>>
> Could a link to that article have saved the time and effort?   I'd like 
> to think so.

It's right at the top. In fact, you quoted it.

If you _only_ wanted the quote, tell yourself that whenever I provided 
just that, people complained that they wanted the whole article to avoid 
venturing onto a web page. You're damned if you do, and you're damned if 
you don't.

-- 
CrudeSausage
MacBook Air M4
iPhone 13
Friendly Apple zealot

[toc] | [prev] | [next] | [standalone]

#149446

On 10/14/26 11:50 AM, CrudeSausage wrote:
> On 2026-10-13 9:09 p.m., Alan K. wrote:
>> On 10/13/26 8:34 PM, CrudeSausage wrote:
>>> <https://shorturl.at/nFg3w>
>>>
>>> Today is Microsoft's October 2026 Patch Tuesday, with security updates
>>> addressing a record-breaking 1,411 flaws, including one actively
>>> exploited and two publicly disclosed zero-day vulnerabilities.
>>>
>>
>>>
>> Could a link to that article have saved the time and effort?   I'd 
>> like to think so.
> 
> It's right at the top. In fact, you quoted it.
> 
> If you _only_ wanted the quote, tell yourself that whenever I provided 
> just that, people complained that they wanted the whole article to avoid 
> venturing onto a web page. You're damned if you do, and you're damned if 
> you don't.
> 
Not true for Alan Faker. No matter what, he will find a way to be 
unbelievably negative. He once posted "I just like to pick fights" or 
some such in this very newsgroup.

[toc] | [prev] | [next] | [standalone]

#149454

On Wed, 10/14/2026 11:50 AM, CrudeSausage wrote:
> On 2026-10-13 9:09 p.m., Alan K. wrote:
>> On 10/13/26 8:34 PM, CrudeSausage wrote:
>>> <https://shorturl.at/nFg3w>
>>>
>>> Today is Microsoft's October 2026 Patch Tuesday, with security updates
>>> addressing a record-breaking 1,411 flaws, including one actively
>>> exploited and two publicly disclosed zero-day vulnerabilities.
>>>
>>
>>>
>> Could a link to that article have saved the time and effort?   I'd like to think so.
> 
> It's right at the top. In fact, you quoted it.
> 
> If you _only_ wanted the quote, tell yourself that whenever I provided just that, people complained that they wanted the whole article to avoid venturing onto a web page. You're damned if you do, and you're damned if you don't.
> 

The shorturl does not support a standard preview option.

Do you know if it has a preview option ?

For example preview.tinyurl.com is one method. It doesn't support that
method, of putting preview in front of the domain.

Or for other link shorteners, putting a "+" on the end is a preview.
It doesn't support that either.

If you present the preview format, then nobody can complain.
Otherwise, there's really no reason (on USENET) to be
using a link shortener, because it implies you want to
hide an exploit you're going to try in a browser.

While a USENET post has a ~1000 character limit for line length,
using the continuation character, you can make lines which are
logically longer than that. Someone once posted a million digits of
PI, as a single line, with continuation characters on the end of each one.
You can easily store a URL in such a capability as that.

This is why I posted the link for Alan, so it would be plaintext
and could be analyzed for trust by the audience.

    https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/

   <https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/>

Whether you put the crap on the ends of it, doesn't matter.

   Paul

[toc] | [prev] | [next] | [standalone]

#149481

On 2026-10-14 17:50, CrudeSausage wrote:
> On 2026-10-13 9:09 p.m., Alan K. wrote:
>> On 10/13/26 8:34 PM, CrudeSausage wrote:
>>> <https://shorturl.at/nFg3w>
>>>
>>> Today is Microsoft's October 2026 Patch Tuesday, with security updates
>>> addressing a record-breaking 1,411 flaws, including one actively
>>> exploited and two publicly disclosed zero-day vulnerabilities.
>>>
>>
>>>
>> Could a link to that article have saved the time and effort?   I'd 
>> like to think so.
> 
> It's right at the top. In fact, you quoted it.

No, that's not the link.

I never open shortlinks, they can be malware.


-- 
Cheers, Carlos.
ES🇪🇸, EU🇪🇺;

[toc] | [prev] | [next] | [standalone]

#149484

On 2026-10-15 3:42 p.m., Carlos E.R. wrote:
> On 2026-10-14 17:50, CrudeSausage wrote:
>> On 2026-10-13 9:09 p.m., Alan K. wrote:
>>> On 10/13/26 8:34 PM, CrudeSausage wrote:
>>>> <https://shorturl.at/nFg3w>
>>>>
>>>> Today is Microsoft's October 2026 Patch Tuesday, with security updates
>>>> addressing a record-breaking 1,411 flaws, including one actively
>>>> exploited and two publicly disclosed zero-day vulnerabilities.
>>>>
>>>
>>>>
>>> Could a link to that article have saved the time and effort?   I'd 
>>> like to think so.
>>
>> It's right at the top. In fact, you quoted it.
> 
> No, that's not the link.
> 
> I never open shortlinks, they can be malware.

That's not a bad approach.

-- 
CrudeSausage
MacBook Air M4
iPhone 13
Friendly Apple zealot

[toc] | [prev] | [next] | [standalone]

#149486

On 10/15/2026 5:30 PM, CrudeSausage wrote:
> On 2026-10-15 3:42 p.m., Carlos E.R. wrote:
>> On 2026-10-14 17:50, CrudeSausage wrote:
>>> On 2026-10-13 9:09 p.m., Alan K. wrote:
>>>> On 10/13/26 8:34 PM, CrudeSausage wrote:

>>>>> <https://shorturl.at/nFg3w>
>>>>>
>>>>> Today is Microsoft's October 2026 Patch Tuesday, with security updates
>>>>> addressing a record-breaking 1,411 flaws, including one actively
>>>>> exploited and two publicly disclosed zero-day vulnerabilities.
>>>>>
>>>> Could a link to that article have saved the time and effort?   I'd 
>>>> like to think so.
>>>
>>> It's right at the top. In fact, you quoted it.
>>
>> No, that's not the link.
>>
>> I never open shortlinks, they can be malware.
> 
> That's not a bad approach.


If I navigate to a bad site, Norton blocks me, I honestly think it's 
worth having over Microsoft Defender.  I consider a Win11 PC to be 
mostly carefree but with that solid antimalware package in place, it 
gives me a reassurance.

-- 
Joel W. Crump

[toc] | [prev] | [next] | [standalone]

#149488

On Oct 15, 2026 at 2:39 PM, Joel W. Crump wrote in
11arh70$2pp06$1@dont-email.me:
> On 10/15/2026 5:30 PM, CrudeSausage wrote:
> > On 2026-10-15 3:42 p.m., Carlos E.R. wrote:
<snip 18 lines>
> >
> > That's not a bad approach.
> 
> 
> If I navigate to a bad site, Norton blocks me, I honestly think it's
> worth having over Microsoft Defender. I consider a Win11 PC to be
> mostly carefree but with that solid antimalware package in place, it
> gives me a reassurance.

Windows has gotten better but a good malware detector is still wise.

-- 
It's impossible for someone who is at war with themselves to be at
peace with you.

[toc] | [prev] | [next] | [standalone]

#149490

On 2026-10-15 5:39 p.m., Joel W. Crump wrote:
> On 10/15/2026 5:30 PM, CrudeSausage wrote:
>> On 2026-10-15 3:42 p.m., Carlos E.R. wrote:
>>> On 2026-10-14 17:50, CrudeSausage wrote:
>>>> On 2026-10-13 9:09 p.m., Alan K. wrote:
>>>>> On 10/13/26 8:34 PM, CrudeSausage wrote:
> 
>>>>>> <https://shorturl.at/nFg3w>
>>>>>>
>>>>>> Today is Microsoft's October 2026 Patch Tuesday, with security 
>>>>>> updates
>>>>>> addressing a record-breaking 1,411 flaws, including one actively
>>>>>> exploited and two publicly disclosed zero-day vulnerabilities.
>>>>>>
>>>>> Could a link to that article have saved the time and effort?   I'd 
>>>>> like to think so.
>>>>
>>>> It's right at the top. In fact, you quoted it.
>>>
>>> No, that's not the link.
>>>
>>> I never open shortlinks, they can be malware.
>>
>> That's not a bad approach.
> 
> 
> If I navigate to a bad site, Norton blocks me, I honestly think it's 
> worth having over Microsoft Defender.  I consider a Win11 PC to be 
> mostly carefree but with that solid antimalware package in place, it 
> gives me a reassurance.

I also think that having a decent additional level of protection is a 
good idea on any computer I own. Nevertheless, I see no point of adding 
that kind of stuff to a Mac.

-- 
CrudeSausage
MacBook Air M4
iPhone 13
Friendly Apple zealot

[toc] | [prev] | [next] | [standalone]

#149491

On 10/15/2026 8:07 PM, CrudeSausage wrote:

>> If I navigate to a bad site, Norton blocks me, I honestly think it's 
>> worth having over Microsoft Defender.  I consider a Win11 PC to be 
>> mostly carefree but with that solid antimalware package in place, it 
>> gives me a reassurance.
> 
> I also think that having a decent additional level of protection is a 
> good idea on any computer I own. Nevertheless, I see no point of adding 
> that kind of stuff to a Mac.


It's specifically because I'm running Winblows, that I'm doing it, yeah. 
  It's part of the cash that goes toward "the cloud" as it were.  But 
they did give me a discount, at least.

-- 
Joel W. Crump

[toc] | [prev] | [next] | [standalone]

#149494

Joel W. Crump wrote:
>>> If I navigate to a bad site, Norton blocks me, I honestly think it's 
>>> worth having over Microsoft Defender.� I consider a Win11 PC to be 
>>> mostly carefree but with that solid antimalware package in place, it 
>>> gives me a reassurance.
>> 
>> I also think that having a decent additional level of protection is a 
>> good idea on any computer I own. Nevertheless, I see no point of adding 
>> that kind of stuff to a Mac.
> 
> 
> It's specifically because I'm running Winblows, that I'm doing it, yeah. 
>   It's part of the cash that goes toward "the cloud" as it were.  But 
> they did give me a discount, at least.

Is this thread about bugs? Or malware? 
This is an INTELLIGENT thread on a huge number of Windows "bugs", right?

The person who said "I see no point of adding that kind of stuff to a Mac"
is a known religious zealot nutcase, but I wonder where he gets his data?
 a. A bug is a flaw in software, right?
 b. Malware is software aimed for malicious intent.

Occam's Razor, right? 
 *They're not the same thing* (even as the end result might sometimes be).

To keep this discussion at the INTELLIGENT level, and not an Apple
marketing endorsement (which is what the religious zealots do), I'd look at
what Apple does that is DIFFERENT from what Windows does, for those two.

For example:
 *Protecting against malware in macOS*
 <https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web>

Those don't seem to protect against bugs. 
 a. Gatekeeper and notarization don't detect bugs
 b. Xprotect only detects known malware, not bugs
 c. System Integrity Protection protects from changes in system files

The INTELLIGENT question to ask, is doesn't Windows have the same things?
 <https://www.microsoft.com/en-us/windows/learning-center/windows-11-security-features>
-- 
Most people religiously believe as gospel everything Apple marketing spews.

[toc] | [prev] | [next] | [standalone]

#149525

On 16/10/2026 03:42, Maria Sophia wrote:

[..]
> For example:
>   *Protecting against malware in macOS*
>   <https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web>
> 
> Those don't seem to protect against bugs.
>   a. Gatekeeper and notarization don't detect bugs
>   b. Xprotect only detects known malware, not bugs
>   c. System Integrity Protection protects from changes in system files

The latter also protects against bugs where one can accidentally 
(because of a bug) overwrite system files. Such bugs do exists and have 
been exploited.

Also, writing with less foaming at the mouth would be welcome; you come 
over as a zealot.

-- 
Static tumblelog generator: https://github.com/john-bokma/tumblelog/
Available as Python or Perl. Example tumblelog: https://plurrrr.com/

[toc] | [prev] | [next] | [standalone]

#149524

On 2026-10-15 23:39, Joel W. Crump wrote:
> On 10/15/2026 5:30 PM, CrudeSausage wrote:
>> On 2026-10-15 3:42 p.m., Carlos E.R. wrote:
>>> On 2026-10-14 17:50, CrudeSausage wrote:
>>>> On 2026-10-13 9:09 p.m., Alan K. wrote:
>>>>> On 10/13/26 8:34 PM, CrudeSausage wrote:
> 
>>>>>> <https://shorturl.at/nFg3w>
>>>>>>
>>>>>> Today is Microsoft's October 2026 Patch Tuesday, with security 
>>>>>> updates
>>>>>> addressing a record-breaking 1,411 flaws, including one actively
>>>>>> exploited and two publicly disclosed zero-day vulnerabilities.
>>>>>>
>>>>> Could a link to that article have saved the time and effort?   I'd 
>>>>> like to think so.
>>>>
>>>> It's right at the top. In fact, you quoted it.
>>>
>>> No, that's not the link.
>>>
>>> I never open shortlinks, they can be malware.
>>
>> That's not a bad approach.
> 
> 
> If I navigate to a bad site, Norton blocks me, I honestly think it's 
> worth having over Microsoft Defender.  I consider a Win11 PC to be 
> mostly carefree but with that solid antimalware package in place, it 
> gives me a reassurance.

I am on Linux :-P

Then I will retort that shortlinks might not survive many years, while 
posts might. If the post contain long full links, the reader gets an 
idea of what might be at the other end before actually going there. The 
destination server may be gone, or has changed location. With the full 
link there is a chance of finding the current, modified link.



-- 
Cheers, Carlos.
ES🇪🇸, EU🇪🇺;

[toc] | [prev] | [next] | [standalone]

#149492

On Oct 13, 2026 at 8:34:32 PM EDT, "CrudeSausage" <crude@sausa.ge> wrote:

> <https://shorturl.at/nFg3w>
> 
> Today is Microsoft's October 2026 Patch Tuesday, with security updates
> addressing a record-breaking 1,411 flaws, including one actively
> exploited and two publicly disclosed zero-day vulnerabilities.

This is supposed to be news?   This is just another day for MS.

Let us know when MS is NOT fixing thousands of flaws.   THAT will be news.  

Because as you noted, there will always be more. 

Meanwhile, there is a dumbass here complaining that Apple fixed TWO flaws and
based on that - get this - is claiming that Apple has "the worst security in
the industry".

It is to laugh.

[toc] | [prev] | [next] | [standalone]

#149493

On 10/15/2026 9:26 PM, Nick Charles wrote:
> On Oct 13, 2026 at 8:34:32 PM EDT, "CrudeSausage" <crude@sausa.ge> wrote:
> 
>> <https://shorturl.at/nFg3w>
>>
>> Today is Microsoft's October 2026 Patch Tuesday, with security updates
>> addressing a record-breaking 1,411 flaws, including one actively
>> exploited and two publicly disclosed zero-day vulnerabilities.
> 
> This is supposed to be news?   This is just another day for MS.
> 
> Let us know when MS is NOT fixing thousands of flaws.   THAT will be news.
> 
> Because as you noted, there will always be more.
> 
> Meanwhile, there is a dumbass here complaining that Apple fixed TWO flaws and
> based on that - get this - is claiming that Apple has "the worst security in
> the industry".
> 
> It is to laugh.


As if Apple is so perfect?

-- 
Joel W. Crump

[toc] | [prev] | [next] | [standalone]

#149495

Joel W. Crump wrote:
> On 10/15/2026 9:26 PM, Nick Charles wrote:
>> On Oct 13, 2026 at 8:34:32 PM EDT, "CrudeSausage" <crude@sausa.ge> wrote:
>> 
>>> <https://shorturl.at/nFg3w>
>>>
>>> Today is Microsoft's October 2026 Patch Tuesday, with security updates
>>> addressing a record-breaking 1,411 flaws, including one actively
>>> exploited and two publicly disclosed zero-day vulnerabilities.
>> 
>> This is supposed to be news?   This is just another day for MS.
>> 
>> Let us know when MS is NOT fixing thousands of flaws.   THAT will be news.
>> 
>> Because as you noted, there will always be more.
>> 
>> Meanwhile, there is a dumbass here complaining that Apple fixed TWO flaws and
>> based on that - get this - is claiming that Apple has "the worst security in
>> the industry".
>> 
>> It is to laugh.
> 
> 
> As if Apple is so perfect?

Joel's response is apropos, IMHO, in that Apple software has as many or
more zero-day holes and bugs as any other software, despite what is
arguably the most brilliant marketing pitch on the planet by Apple.

 *We prevent you from doing anything - which we say - keeps you safe!*

For some reason, people believe that since Apple devices can't do half of
what every other device does, somehow (magically?) that keeps them safe.

It's like a butterknife is 'safer' for cutting trees than a chainsaw.
 *Comparing iOS/macOS to Android/Windows is a similar comparison*

Apple's (rather brilliant) marketing pitch is:
 * Hey, we know you can't do anything useful on our devices
 * But that keeps you safer!

Despite Apple's claim of "safety thru inability", CISA says otherwise: 
 <https://www.cisa.gov/known-exploited-vulnerabilities-catalog>

Nonetheless, if we wish to have an INTELLIGENT discussion on the sheer
number of bugs fixed per any given time period, that's maybe worthwhile.

You have to admit, the recent numbers sure are lower, but we have to look
at the time periods and the fact that Apple's QA is known to be atrocious.
 *Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases*
 <https://www.securityweek.com/apple-patches-200-vulnerabilities-with-new-ios-27-macos-golden-gate-27-releases/> 
 "The updates resolve kernel vulnerabilities that could lead to 
  memory corruption, privilege escalation, system termination,
  and information leaks. Approximately 100 of the resolved security 
  defects affect both the mobile and desktop operating systems.
  The fixes target more than 90 platform components, including 
  AppleKeyStore, Authentication Services, Foundation, Safe Browsing, 
  Sandbox, Security, TCC, and WebKit."

I've been studying the typical Apple poster to Usenet for decades.
They're not like normal people. That's for sure.

They've invested tremendously in the Apple marketing mystique. 
And they'll defend it to the death, no matter what. 
Using ht efirst absurd excuse that comes to their mind.

For some reason, they think 200 bugs is better than 1400, and, well, if
bugs were that simple, it would be... but they're not that simple.

A lot depends on the bugs that Apple's QA missed, given Google proved Apple
doesn't test huge portions of their code so, that makes s difference.
 <https://cyberscoop.com/iphone-hack-google-project-zero/>

But even if Apple did test their code even once, their QA is so bad that
small children find huge holes in their software (e.g., Facetime).

And even so, the sheer *number* of bugs in Apple software isn't known fron
only one release, just as it's not known from one Windows update either.

What does matter though, which most Apple owners have no clue about, is
Apple has NEVER fully patched anything but the current release.
<https://arstechnica.com/gadgets/2022/10/apple-clarifies-security-update-policy-only-the-latest-oses-are-fully-patched/>
<https://screenrant.com/apple-product-security-update-lifespan/>
<https://hothardware.com/news/apple-admits-only-fully-patches-security-flaws-in-latest-os-releases>

That's IMPORTANT given Windows does fully patch multiple releases.
In fact, I think ONLY APPLE does not fully patch prior releases.

So, an INTELLIGENT question to ask of the team is:
 Q: Is it ONLY APPLE that never fully patches older releases? 
 A: ? 

-- 
Most people can't process even simple things that they do not understand.

[toc] | [prev] | [next] | [standalone]

#149496

On Oct 15, 2026 at 9:27:57 PM EDT, ""Joel W. Crump"" <joelcrump@gmail.com>
wrote:

> On 10/15/2026 9:26 PM, Nick Charles wrote:
>> On Oct 13, 2026 at 8:34:32 PM EDT, "CrudeSausage" <crude@sausa.ge> wrote:
>> 
>>> <https://shorturl.at/nFg3w>
>>> 
>>> Today is Microsoft's October 2026 Patch Tuesday, with security updates
>>> addressing a record-breaking 1,411 flaws, including one actively
>>> exploited and two publicly disclosed zero-day vulnerabilities.
>> 
>> This is supposed to be news?   This is just another day for MS.
>> 
>> Let us know when MS is NOT fixing thousands of flaws.   THAT will be news.
>> 
>> Because as you noted, there will always be more.
>> 
>> Meanwhile, there is a dumbass here complaining that Apple fixed TWO flaws and
>> based on that - get this - is claiming that Apple has "the worst security in
>> the industry".
>> 
>> It is to laugh.
> 
> 
> As if Apple is so perfect?

When did I say that?  

The fact is, TWO flaws is WAY better than 1,400.   Right? 

STILL laughable.

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.sys.mac.advocacy

csiph-web