Microsoft fixed more than 1,400 flaws in one day, and one was already being used

Microsoft's October update is the biggest in the company's history. Depending on who is counting, it closed between 1,411 and 1,413 separate security flaws across Windows, Office, SharePoint, SQL Server and the developer tools, with 70 of them rated Critical. For comparison, Microsoft has now fixed more than 4,000 vulnerabilities in 2026 alone, which is more than the whole of 2025.

One of them was already being used against real people. CVE-2026-96951 is a Windows Shell flaw, scored 8.8 out of 10, that lets a crafted file arriving by email or chat slip past Mark of the Web. That is the invisible tag Windows attaches to anything downloaded from the internet, and it is the reason you normally see a warning before a downloaded document or installer runs. Strip the tag and the warning never appears. Researchers at Fujitsu and Anthropic plus an independent reporter flagged it, and the US cyber agency CISA gave federal agencies until 16 October to patch.

The sheer size of the release says something about how software security works now. The Zero Day Initiative's read is blunt: AI is not inventing these bugs, it is shortening the gap between a flaw existing and somebody noticing it. Both sides get that speed boost, which is an argument for not sitting on updates for three weeks.

There is a second thing worth checking. 13 October was the last update Windows 11 version 24H2 Home and Pro will ever receive. Most people were moved to 25H2 or 26H2 automatically, but if your PC stalled somewhere in that process it is now frozen on a version with no more security fixes. Tendvane's Windows Update repair wizard is built for exactly that situation, where updates keep failing and nothing obvious explains why.