It has been a busy stretch for Microsoft's security teams and for the administrators who rely on them. In the past six weeks Microsoft has shipped another record-sized Patch Tuesday, seen a SharePoint flaw move from patched to actively attacked, been dragged into a supply-chain attack on Microsoft 365 tenants, pulled trust from a certificate authority, and confirmed a string of bugs introduced by its own updates. Here is what happened and what to do about it.
October Patch Tuesday: a record haul and one exploited zero-day
Microsoft's October 13 release fixed well over 1,400 vulnerabilities. Outlets count slightly differently: BleepingComputer reported 1,411 flaws, while SecurityWeek and Malwarebytes cited 1,413. SecurityWeek noted that Microsoft has now patched more flaws in a single month than in all of 2025, with the surge largely driven by AI-assisted bug finding.
- CVE-2026-96951 (CVSS 8.8) is a Windows Shell security feature bypass that is already being exploited. It defeats Mark of the Web, the tag that makes Windows warn about files downloaded from the internet, so a booby-trapped file sent by email or chat can run without the usual warnings. The victim still has to open it. CISA added it to its Known Exploited Vulnerabilities catalog the same day, and SecurityWeek reports a federal deadline of October 16.
- CVE-2026-108398 is a publicly disclosed .NET Framework bypass of Windows Defender Application Control, credited to Google Project Zero's James Forshaw. Microsoft does not believe it is likely to be exploited.
- CVE-2026-92707 is a publicly disclosed denial-of-service flaw in MessagePack-CSharp.
SharePoint flaw goes from patched to attacked
CVE-2026-65660, a SharePoint Server remote code execution flaw fixed in August, began to be exploited in late September. Microsoft updated its advisory to say it had reliable evidence of attacks as of September 25, and CISA added it to the KEV catalog that day. SecurityWeek reports that exploitation followed the public release of technical details by Viettel Security, and that attempts to plant a web shell were seen. The flaw needs a low-privileged account, so it is most dangerous when chained with another bug.
ConnectWise supply-chain attack hits Microsoft 365 tenants
In mid-October attackers abused application identities belonging to ConnectWise's Cloud Backup service (formerly SkyKick) to sign in to customers' Microsoft 365 environments with permissions those customers had already granted. Because the sign-ins used app credentials rather than a user login, MFA did not stop them. Microsoft's October 21 write-up attributes the activity to Storm-0940, a China-aligned group, which used an AI penetration-testing framework called ARTEX to try more than 2,250 tenants and, in some cases, reach privileged cloud access in under three hours. Microsoft stresses this was not a compromise of its own systems, and that a successful sign-in does not prove data was taken. ConnectWise shut down the affected services and disabled the application identities.
Certificate authority keys compromised
On October 26 Microsoft explained its response to eight weak eMudhra intermediate CA private keys that could be recovered. It blocked them in the Windows disallowed certificate list on October 20, and on October 26 released out-of-band updates removing seven eMudhra-related certificates from the Windows trust list, with the same change planned for Edge on October 27. eMudhra says the affected intermediates had not issued publicly trusted certificates and that its infrastructure was not breached.
Updates that broke things
- Exchange: the October Windows Server updates can cause Outlook on the web sign-in failures and stuck mail on busy Exchange servers, because of a new Endpoint Mapper limit. Microsoft published a registry workaround.
- Remote Desktop: Windows 11 hosts with Administrator protection enabled can reject non-admin RDP users with error 0xC000000D. This follows September's emergency fixes for Remote Desktop Services failures.
- Smart App Control may be greyed out after KB5127648, and Microsoft admitted it wrongly marked an Always On VPN bug as fixed.
What to do
- Install the October updates, prioritising internet-facing and email-exposed systems for CVE-2026-96951, and patch SharePoint Server to the August build or later.
- Search every tenant for the ConnectWise application IDs, even unused ones, review service-principal sign-ins and credential changes since October 13, and keep the apps disabled until ConnectWise says otherwise.
- Make sure offline Windows systems receive the updated certificate trust lists, and replace any certificates chaining to the removed roots.
- Test updates on a pilot group and apply Microsoft's documented workarounds rather than uninstalling security fixes.
Sources
- BleepingComputer: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
- SecurityWeek: Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
- CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog
- SecurityWeek: Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks
- BleepingComputer: Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
- Microsoft Security Blog: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
- The Register: Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
- MSRC: Microsoft's response to compromised eMudhra certificate authority keys
- eMudhra: Statement on Recent Certificate Security Incident
- BleepingComputer: Microsoft: October Windows Server updates break Exchange sign-in, mail flow
- BleepingComputer: Microsoft: Recent Windows updates may trigger Remote Desktop failures
- BleepingComputer: Microsoft: October Windows update may break Smart App Control
- BleepingComputer: Microsoft says October updates didn't actually fix VPN issues
Related: Microsoft Ships Emergency Fix After September Updates Break Remote Desktop on Windows Server.
0 Comments