Microsoft's October Patch Tuesday fixes 1,411 flaws, one exploited
Microsoft's October 2026 Patch Tuesday fixed over 1,400 flaws, including an exploited Windows Shell bypass (CVE-2026-96951) and a disclosed .NET bug (CVE-2026-108398).
Stories tagged: #windows
Zoom Workplace on Windows: CVE-2026-53412 lets a network attacker take an account
Zoom bulletin ZSB-26014 patches CVE-2026-53412, a CVSS 9.8 pre-auth account takeover in Zoom Workplace and the VDI client for Windows. Update to 7.0.0 / 7.0.10 / 6.6.15 / 6.5.18.
LegacyHive drops Windows profsvc zero-day PoC after Patch Tuesday
Nightmare Eclipse published LegacyHive on GitHub the same day as Microsoft's July 2026 Patch Tuesday. It's an unpatched profsvc LPE that still works on fully-updated Windows.
Microsoft patches Defender RoguePlanet LPE CVE-2026-50656
Microsoft shipped Malware Protection Engine 1.1.26060.3008 on July 9 to close a race condition in mpengine.dll that hands SYSTEM to any local user. Public PoC has been circulating for a month.