Microsoft released more than 1,400 security fixes on October 13. That is not a typo. September’s batch of nearly 1,000 was already about ten times a normal month, and October blew past it. At least 78 of this month’s bugs are rated critical, meaning an attacker could run code on your machine with little or no action from the person sitting at it.
Krebs on Security reports that Microsoft credits large language models for finding this volume of bugs. Tenable’s Satnam Narang noted that Microsoft has now crossed 4,000 patched vulnerabilities this year with two months still to go. The old record was 1,261 for all of 2020.
Here is what that actually means if you run a ten-person office.
Patch volume is no longer a one-month problem
Big companies have security teams that test every update against their line-of-business software before pushing it out. That process is buckling. When the monthly load goes from 100 fixes to 1,400, “we’ll test it first” turns into “we never got to it,” and machines sit unpatched for months.
Small businesses have the opposite problem and, honestly, the easier one. You probably do not have a custom app that breaks when Windows updates. For most law offices, dental practices, and contractors, the right policy is simple: let the updates install, reboot on a schedule, and verify they actually landed. The risk of a patch breaking QuickBooks is far smaller than the risk of running a Windows build from four months ago.
The verification part is where most offices fall down. Windows Update will happily download a patch, mark it “pending restart,” and sit there for six weeks because nobody reboots a machine that goes to sleep every night instead of shutting down. A patch that is downloaded but not applied protects nothing.
One is already being used against people
Out of 1,400 fixes, exactly one is a zero day: CVE-2026-96951, a security feature bypass in the Windows Shell affecting Windows 10, Windows 11, and some Server versions. Attackers are already using it. A second one, a .NET Framework bypass tracked as CVE-2026-108398, was publicly disclosed before Patch Tuesday, which gives criminals a head start even though nobody has reported attacks yet.
That ratio is the useful part. Tyler Reguly at Fortra pointed out that only 26 Microsoft vulnerabilities have landed in CISA’s Known Exploited Vulnerabilities catalog all year. Thousands of CVEs, 26 confirmed to be used in real attacks. The KEV catalog is the list that matters, and it is free and public. CISA just added the two critical PHP bugs to it on October 26, which is the same pair of flaws that knocked websites offline last week and that we covered in an earlier post.
So the decision rule is: apply everything, but if something has to jump the line, it is whatever shows up in KEV.
Windows 10 is alive until October 2027
Worth knowing, because a lot of vendors are using the old deadline to sell hardware. Microsoft was going to stop updating Windows 10 in October 2025, extended it a year after pushback, and then quietly extended it again to October 2027.
That is not permission to stop thinking about it. It is a planning window. If you have fifteen Windows 10 machines and no budget line for replacing them, you now have four quarters to spread that purchase out instead of doing it in a panic next fall. Figure out which of your machines can actually run Windows 11 and which cannot, because that tells you how big the bill is.
What to do this week
- Confirm October’s updates actually installed. On each machine, open Windows Update and look for “pending restart.” Reboot anything that is sitting there. One unpatched laptop is enough.
- Set a reboot policy and tell people about it. Weekly, after hours, non-negotiable. Fighting about this once beats chasing it every month.
- Find your stragglers. The reception PC that nobody logs into, the machine in the back running the label printer, the laptop of the employee who left in August. Those are the ones that are four builds behind.
- Count your Windows 10 machines and check Windows 11 eligibility. Build a replacement plan that ends before October 2027.
- Patch .NET too. It gets skipped constantly because it is not visible to users, and the publicly disclosed bypass this month means attackers have had time to study it.
Patching is the least glamorous thing in security and the one that would have prevented most of the incidents we get called about. It is also the kind of work that just has to happen every month, which is exactly why it is part of what we handle for clients under managed IT, alongside the endpoint detection (what we deploy) that catches the things a patch missed.
If you are not sure whether your machines are current and you do not have an easy way to check, that is a short conversation. Book a free 15-minute consult.