What happened
On 13 October 2026 (14 October in Australia), Microsoft released its monthly security updates, often called “Patch Tuesday”. It was an unusually large release: more than 1,400 vulnerabilities were fixed across Windows, Office and other Microsoft products.
One of them, CVE-2026-96951 in Windows Shell, was already being used by attackers before the fix came out. It lets a specially crafted file get around “Mark of the Web”, the label Windows puts on files that come from the internet so that SmartScreen and Office Protected View can warn you before you open them. The attack still needs someone to open a file or click a link, for example in an email or chat message.
On the same day, Microsoft confirmed that Windows 11 version 24H2 Home and Pro editions have reached end of updates. The October update was the last security update for those editions. (Enterprise and Education editions of 24H2 are supported until October 2027.)
Does it affect you?
If your business uses Windows PCs, the October updates apply to you. Computers that have not installed them yet are missing the fix for a flaw that is being used in real attacks.
If any of your computers run Windows 11 Home or Pro, version 24H2, they will not receive any more security fixes until they move to a newer version (25H2 or 26H2). You can check under Settings > System > About, in the “Windows specifications” section.
What we’re doing and what you can do
If you’re a managed client: we’ll check that the October updates have installed on the computers we look after, and we’ll contact you if any PCs need attention or a version upgrade.
For everyone:
- Open Settings > Windows Update, select Check for updates, and restart when asked.
- If a PC is on Windows 11 24H2 Home or Pro, install the newer version (Windows 11, version 26H2) when Windows Update offers it. Microsoft says a single restart completes it.
- Keep automatic updates turned on, as the Australian Cyber Security Centre recommends.
- Take care with unexpected attachments and links, even after updating.
Not sure where your computers are up to? Call us on (1800) 30 22 32 or email helpdesk@alliance-net.com.au.
Sources
- Microsoft Learn: Windows 11, version 24H2 known issues and notifications
- Microsoft Learn: Windows message center (end of updates notice, 13 October 2026)
- Microsoft Security Response Center: CVE-2026-96951
- BleepingComputer: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
- Malwarebytes: Update Windows: Record Patch Tuesday fixes flaw already under attack
- Australian Cyber Security Centre: How-to guides for small business