Image: Malwarebytes Labs
Microsoft’s October security update fixes 1,413 vulnerabilities, including a Windows Shell flaw already being exploited. Windows users should install the available updates and restart their PCs to complete the process.
Check Windows Update now
Malwarebytes Labs advises users to open Settings, select Windows Update and click Check for updates. Install everything offered, restart when prompted, then check again until Windows reports that the PC is up to date.- Open Start, then Settings and Windows Update.
- Select Check for updates and install the available updates.
- Restart the PC, return to Windows Update and check once more.
Why the exploited flaw matters
CVE-2026-96951 is rated 8.8 out of 10 and can bypass Mark of the Web, a Windows safeguard that warns users about potentially unsafe downloaded files. Weakening this warning does not remove every layer of Windows protection, but it can make a malicious download appear less suspicious.An attacker could send a specially crafted file through email or instant messaging. Exploitation is not automatic: the target must click a link or open an attachment.
Two publicly known issues also patched
CVE-2026-108398, also rated 8.8, affects .NET Framework and can let an authorized local attacker bypass Windows Defender Application Control. That feature controls which applications are permitted to run, so exploitation could allow unauthorized software to start.CVE-2026-92707, rated 5.3, can let an unauthenticated remote attacker exhaust application memory through specially crafted MessagePack data. The practical exposure depends on how an application uses the MessagePack-CSharp component.
