Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.sys.mac.advocacy > #149414
| Date | 2026-10-13 20:34 -0400 |
|---|---|
| Newsgroups | comp.sys.mac.advocacy, alt.comp.os.windows-11, comp.os.linux.advocacy |
| From | CrudeSausage <crude@sausa.ge> |
| Subject | Microsoft patches 1,411 flaws and 3 0-days to make room for more |
| Message-ID | <6acece18$0$20$882e4bbb@reader.netnews.com> (permalink) |
Cross-posted to 3 groups.
<https://shorturl.at/nFg3w>
Today is Microsoft's October 2026 Patch Tuesday, with security updates
addressing a record-breaking 1,411 flaws, including one actively
exploited and two publicly disclosed zero-day vulnerabilities.
This Patch Tuesday addresses 70 "Critical" vulnerabilities, 57 of which
are remote code execution, 11 are elevation of privileges, and 2 are
spoofing.
The approximate number of bugs in each vulnerability category is listed
below:
677 Elevation of Privilege Vulnerabilities
40 Security Feature Bypass Vulnerabilities
317 Remote Code Execution Vulnerabilities
254 Information Disclosure Vulnerabilities
73 Denial of Service Vulnerabilities
28 Spoofing Vulnerabilities
When BleepingComputer reports on Patch Tuesday security updates, we only
count vulnerabilities released by Microsoft on Patch Tuesday itself.
Therefore, today's total excludes 348 flaws fixed earlier this month,
including vulnerabilities in Azure API Center, Azure App Service, Azure
Event Grid, Azure SRE Agent, Mariner, Microsoft Bookings, Microsoft
Dataverse, Microsoft Exchange Server, and Microsoft Partner Center.
This is a record-breaking Microsoft Patch Tuesday as Microsoft continues
to use artificial intelligence platforms to find and remediate security
vulnerabilities in its products.
Microsoft announced today that Windows 11, version 24H2 Home and Pro,
and Windows 10 Enterprise LTSB 2016 have reached end of support.
"Today, October 13, 2026, Windows 11, version 24H2 Home and Pro, and
Windows 10 Enterprise LTSB 2016 have reached end of updates. The October
2026 monthly security update is the last update available for these
editions," Microsoft said.
Earlier this month, Microsoft also said organizations running Windows 11
23H2 Enterprise, Education, and IoT Enterprise editions should upgrade
to newer versions as they will no longer receive security updates
starting next month.
To learn more about the non-security updates released today, you can
review our dedicated articles on the Windows 11 KB5127648 & KB5126653
cumulative updates and the Windows 10 KB5126657 extended security update.
Microsoft patches 2 zero-days
This month's Patch Tuesday fixes one actively exploited and two publicly
disclosed zero-day vulnerabilities.
Microsoft classifies a zero-day flaw as publicly disclosed or actively
exploited when no official fix is available.
The actively exploited zero-day vulnerabilities addressed during this
October 2026 Patch Tuesday are:
CVE-2026-96951 - Windows Shell Security Feature Bypass Vulnerability
Microsoft patched an actively exploited zero-day security bypass flaw
that allowed attackers to bypass the Mark of the Web security feature.
"Improper neutralization of special elements used in a command ('command
injection') in Windows Shell allows an unauthorized attacker to bypass a
security feature over a network," warns Microsoft.
No details have been shared on how attackers exploited the flaw or who
disclosed it.
The two zero-days that were publicly disclosed are:
CVE-2026-108398 - .NET Framework Security Feature Bypass Vulnerability
Microsoft has fixed a security feature bypass in the .NET Framework that
can be exploited to run unauthorized applications.
"Untrusted search path in .NET Framework allows an authorized attacker
to bypass a security feature locally," explains Microsoft.
Microsoft says this flaw could allow attackers to bypass Windows
Defender Application Control (WDAC) enforcement and run unauthorized
applications.
"An authenticated attacker could place a specially crafted .NET assembly
on an affected system and register it for loading by a protected
process." Microsoft says.
"Successful exploitation could bypass Windows Defender Application
Control restrictions and allow the attacker to execute code within the
protected process. User interaction is not required."
James Forshaw of Google Project Zero discovered the flaw.
CVE-2026-92707 - MessagePack-CSharp Denial of Service Vulnerability
Microsoft fixed a denial-of-service flaw in MessagePack-CSharp.
"Improperly controlled sequential memory allocation in .NET allows an
unauthorized attacker to deny service over a network," explains Microsoft.
Microsoft has not shared who disclosed the vulnerability.
Recent updates from other companies
Other vendors who released updates or advisories in October 2026 include:
Adobe released security updates for numerous products, including
Commerce, Substance 3D Samples, ColdFusion, Photoshop, Dimension, and
Framework.
Atlassian released security updates for a critical vulnerability
(CVE-2026-21589) in multiple self-hosted Data Center products, including
Confluence, Jira, and Bitbucket. Attackers soon exploited the flaw after
a PoC was released.
Cisco released security updates for numerous products, including
critical vulnerabilities in its NX-OS data center network operating
system that can let attackers run arbitrary code with root privileges on
Nexus switches.
Citrix released security updates for NetScaler ADC and NetScaler Gateway
flaws, with CVE-2026-88779 exploited in zero-day attacks before it was
patched.
Dell released security updates for critical vulnerabilities in the
System Update (DSU) command-line interface (CLI) deployment tool and
Container Storage Modules (CSM).
Docker patched a critical flaw in DockerHub that lets attackers
impersonate users and push images from others' repositories.
Fortinet released security updates for numerous products, including a
critical FortiMail vulnerability (CVE-2026-104286) that attackers
exploited in zero-day attacks.
GitLab released security updates for critical flaws in AI Gateway and
CI/CD Regular Expression Compiler.
Ivanti released security updates for an actively exploited zero-day
vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.
Kiteworks released security updates for 126 vulnerabilities, including a
max-severity flaw affecting its Email Protection Gateway (EPG) security
solution.
Progress Software released security updates for critical and high
security vulnerabilities in MarkLogic Server.
SAP released the October security updates, addressing 20 security flaws,
including a maximum-severity OAuth2 SSRF vulnerability in Cloud SDK for
Python.
SonicWall released security updates for a critical SMA1000 server-side
request forgery (SSRF) flaw, which attackers exploited within two days.
New risk cohorts help prioritize security updates
With this month's record-breaking number of vulnerabilities, Microsoft
has also introduced a new method for organizations to prioritize
security updates by grouping related flaws into what it calls "risk
cohorts."
The new approach groups similar vulnerabilities together to help
organizations better understand which security flaws pose the greatest
risk to their systems and should be prioritized for patching.
For October 2026, Microsoft published 15 risk cohorts, including:
136 vulnerabilities affecting Windows filesystems, storage, and backup.
135 vulnerabilities involving Office documents and mail clients.
131 vulnerabilities affecting Windows graphics, media, and content
processing.
109 vulnerabilities involving Windows core and kernel privilege boundaries.
103 vulnerabilities affecting Windows installation, deployment, and
update services.
Microsoft stressed that these groups do not necessarily indicate which
flaws are the most dangerous, as the actual risk depends on whether they
are being exploited in attacks, their severity, and how an organization
uses the affected software.
Microsoft says the new approach is still experimental and is meant to
help organizations prioritize security updates, not replace its existing
patching recommendations.
Microsoft has published a PDF mapping the October 2026 vulnerabilities
to their respective risk cohorts.
--
CrudeSausage
MacBook Air M4
iPhone 13
Friendly Apple zealot
Back to comp.sys.mac.advocacy | Previous | Next — Next in thread | Find similar | Unroll thread
Microsoft patches 1,411 flaws and 3 0-days to make room for more CrudeSausage <crude@sausa.ge> - 2026-10-13 20:34 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more "Alan K." <alan@invalid.com> - 2026-10-13 21:09 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Paul <nospam@needed.invalid> - 2026-10-13 23:29 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Tom Elam <thomas.e.elam@gmail.com> - 2026-10-14 11:27 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more CrudeSausage <crude@sausa.ge> - 2026-10-14 11:50 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Tom Elam <thomas.e.elam@gmail.com> - 2026-10-14 18:30 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Paul <nospam@needed.invalid> - 2026-10-14 20:02 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more "Carlos E.R." <robin_listas@es.invalid> - 2026-10-15 21:42 +0200
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more CrudeSausage <crude@sausa.ge> - 2026-10-15 17:30 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more "Joel W. Crump" <joelcrump@gmail.com> - 2026-10-15 17:39 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-10-15 15:46 -0700
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more CrudeSausage <crude@sausa.ge> - 2026-10-15 20:07 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more "Joel W. Crump" <joelcrump@gmail.com> - 2026-10-15 20:30 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Maria Sophia <mariasophia@comprehension.com> - 2026-10-15 18:42 -0700
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more John Bokma <contact@johnbokma.com> - 2026-10-17 19:55 +0200
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more "Carlos E.R." <robin_listas@es.invalid> - 2026-10-17 19:49 +0200
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Nick Charles <none@none.none> - 2026-10-16 01:26 +0000
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more "Joel W. Crump" <joelcrump@gmail.com> - 2026-10-15 21:27 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Maria Sophia <mariasophia@comprehension.com> - 2026-10-15 19:07 -0700
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Nick Charles <none@none.none> - 2026-10-16 02:36 +0000
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Maria Sophia <mariasophia@comprehension.com> - 2026-10-15 19:50 -0700
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more "Joel W. Crump" <joelcrump@gmail.com> - 2026-10-15 23:06 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Paul <nospam@needed.invalid> - 2026-10-16 06:47 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Maria Sophia <mariasophia@comprehension.com> - 2026-10-16 09:33 -0700
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Paul <nospam@needed.invalid> - 2026-10-16 15:37 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Maria Sophia <mariasophia@comprehension.com> - 2026-10-16 21:49 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more CrudeSausage <crude@sausa.ge> - 2026-10-16 08:06 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Truth in Writing <OnlyTruthMatters@is.invalid> - 2026-10-16 16:38 +0000
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more CrudeSausage <crude@sausa.ge> - 2026-10-16 13:02 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more CrudeSausage <crude@sausa.ge> - 2026-10-16 08:04 -0400
Re: Microsoft patches 1,411 flaws and 3 0-days to make room for more Paul <nospam@needed.invalid> - 2026-10-16 10:01 -0400
csiph-web