Microsoft fixes a record 1,400 flaws in one update

Microsoft released its monthly security update, known as Patch Tuesday, on October 13, 2026. It fixed more than 1,400 security flaws in its software. Security outlets say this is the first time a single monthly update has fixed more than 1,000 flaws.

The exact number depends on how flaws are counted. BleepingComputer counts 1,411, not including 348 flaws Microsoft fixed earlier in the month. CrowdStrike counts 1,413, Trend Micro's Zero Day Initiative (ZDI) counts 1,415, and PCWorld reports 1,416. BleepingComputer says 70 flaws are rated "critical", while other counts go up to 85 or 86.

One flaw was already being used by attackers before the fix. It is tracked as CVE-2026-96951 and affects Windows Shell. According to Security Affairs, it lets attackers get around the "Mark of the Web" protection, but the victim must first click a link or open a malicious file. Two other flaws, in .NET Framework and MessagePack-CSharp, were made public before a fix, but were not reported as exploited.

According to ZDI, this one month contains more flaws than Microsoft fixed in any previous full year. Reports link the rise to the growing use of AI tools to search for bugs, including by Microsoft itself. It is not clear how much AI contributed this month. Microsoft also tested a new way to group related flaws, called "risk cohorts", and said this method is still experimental.

This update is the last one for Windows 11 version 24H2 Home and Pro, according to BleepingComputer. The next Patch Tuesday is planned for November 10, 2026.