October Patch Tuesday: record 1,407 patches and two zero-days

Microsoft's October Patch Tuesday fixed 1,407 CVEs, surpassing the previous monthly record of 964 and the full-year 2020 total of 1,261. Two zero-days were patched, including the actively exploited Windows Shell security bypass CVE-2026-96951. More than 4,000 CVEs have been patched so far in 2026.

• October Patch Tuesday fixed 1,407 CVEs vs 964 the previous month
• Two zero-days patched, one exploited in the wild
• CVE-2026-96951 is a Windows Shell bypass, the third such flaw this year
• Over 4,000 CVEs patched so far in 2026