A record-size monthly update includes vulnerabilities already exploited in the wild, among them a Windows Shell security feature bypass.
This article is not yet available in your language; it is shown in English.
Microsoft's October 2026 security updates fix 1,411 vulnerabilities, including three zero-days. JPCERT/CC's alert notes that exploitation could allow remote code execution or bypass of security features, and that Microsoft reports CVE-2026-96951, a Windows Shell security feature bypass, as exploited.
These are client and server OS flaws rather than website issues, but a compromised admin or developer workstation is a common first step towards the servers and cloud accounts behind a site.
The two PHP core flaws fixed on 21 October are now in CISA's Known Exploited Vulnerabilities catalog, and JPCERT/CC reports public exploit code and attack traffic.
On 31 October the FBI officially blamed North Korea for the 29 October Binance theft, the largest on record. Elliptic counts $6.43 billion stolen and $2.85 billion frozen. The FBI says the hackers are converting assets mainly into ETH and asks crypto services to block their addresses.
An unauthorised party used a system account's login to read reservation data on Amadeus systems from August 2023 to September 2026. JAL reports about 92,000 customers affected, ANA about 37,800 and Cathay Pacific about 53,000 bookings; some passport numbers were exposed.