Install Microsoft’s October security update this week. Go to Settings > Windows Update, click “Check for updates,” install the October update and restart. On Windows 11 24H2 it’s KB5127648; to confirm it landed, open Settings > System > About and look for OS build 26100.9711 or later. Security firms counted more than 1,400 fixes in this release, and both Tenable and Qualys call it Microsoft’s largest Patch Tuesday ever. The one that matters most: Microsoft says attackers are already using a Windows flaw (CVE-2026-96951) that lets a booby-trapped file, sent by email or chat, open without the warning Windows normally shows for files from the internet. Someone still has to open the file, so until the update is installed, don’t open attachments you weren’t expecting, even from people you know. Windows 10 PCs outside Extended Security Updates don’t get this fix, which is one more reason to enroll or move off Windows 10.
IT managers: push the October cumulative updates with Friday, Oct 16 as your target. That’s the deadline CISA gave federal agencies when it added the flaw to its exploited list Tuesday. Start with the machines people use for email and chat. Also schedule your servers this cycle: the Zero Day Initiative’s Dustin Childs, quoted by Help Net Security, counts 55 “wormable” fixes across server roles such as DHCP Server, Remote Desktop Gateway and Network Policy Server. Find any Windows 10 machines outside ESU, since they can’t get the fix. And a reminder from yesterday: 24H2 Home and Pro machines need to move to 25H2 or 26H2 to keep getting updates.
Ivanti Connect Secure owners: upgrade the appliance today, then check it for signs of a break-in. CISA says attackers have used a flaw in the VPN (CVE-2026-104935) to steal credentials and data, and Volexity, which found the attacks, says they date to early October and let attackers take over some boxes without logging in. Ivanti calls the exploitation “limited,” but per BleepingComputer it says: “If you are running one of the impacted versions, Ivanti recommends you act immediately.” Fixed versions, per Rapid7, are 25.1.1.2, 25.1.3.x, or 22.8R2.5 if you can’t move to 25.x yet. Don’t treat a clean result from Ivanti’s Integrity Checker as proof you’re safe: CISA warns it may not detect this, so review VPN logins and Active Directory activity since early October, bring in your incident-response provider if anything looks off, and reset credentials that passed through the appliance if you find signs of compromise. Volexity says a second flaw used in the attacks isn’t patched yet, so don’t assume this is fully fixed. Plan your move off 22.8 before it reaches end of life on Jan 31, 2027. CISA’s deadline for federal agencies is Friday. Consumers have nothing to do here; if your employer’s VPN acts up this week, it’s probably the patch.