Microsoft released its October security updates on October 13, addressing 1,411 vulnerabilities, including three zero-days. One vulnerability, CVE-2026-96951, is being actively exploited, while two others were publicly disclosed before patches became available. The release includes 70 critical-severity flaws, spanning remote code execution, privilege escalation, information disclosure and security feature bypasses. The scale of the update and confirmed exploitation make patch prioritisation particularly important for organisations relying on Microsoft products. CVE-2026-96951 affects Windows Shell and allows attackers to bypass Mark of the Web protections, which help identify files downloaded from untrusted sources. Exploitation could weaken a key security safeguard and increase the risk of users opening malicious files. The other publicly disclosed issues affect the .NET Framework and MessagePack-CSharp, involving a security feature bypass and a denial-of-service vulnerability, respectively. Although these flaws differ in impact and severity, the actively exploited Windows vulnerability should receive immediate attention, followed by assessment of the other exposed components. Organisations should prioritise deployment of the fixes for actively exploited and publicly disclosed vulnerabilities, then roll out the remaining applicable updates across supported Windows systems and other affected Microsoft products. Security teams should verify patch coverage, identify unpatched internet-facing and business-critical systems, and monitor for suspicious activity that could indicate exploitation. Administrators should also review operating-system support status, as Windows 11 version 24H2 Home and Pro editions have reached the end of support and require an upgrade to a supported release to continue receiving security updates.