Microsoft just fixed more than 1,400 security flaws, and one is already being exploited. Update Windows
October's record Patch Tuesday fixes over 1,400 flaws, including a Windows bug used in attacks that silences download warnings. What it means and what to do.
Stated by the maker, publisher, or platform holder.
Microsoft's monthly security update, released on 13 October, is the biggest it has ever shipped. It fixes more than 1,400 vulnerabilities across Windows, Office and its other products, and one of them is already being used in attacks.
If you use Windows, the short version is: install this month's update now.
What's confirmed
Why that one matters
Mark of the Web is what triggers the warnings you see when you open a downloaded file: SmartScreen, Office's Protected View, the block on macros in downloaded documents. As Dark Reading reports, a file that bypasses it opens as if you'd created it yourself, with none of those warnings, which "turns off several controls at once."
The attack still needs you to open the file, usually sent by email or message. That's exactly the situation the warnings exist for.
What to do
Update Windows now. Open Settings, go to Windows Update, and install the October updates. Restart when asked; the fix isn't in place until you do.
Update Office too. This month also fixes a critical Outlook flaw rated 9.8 out of 10 that, according to Dark Reading, can be triggered through the Reading Pane without you opening anything.
Be wary of unexpected attachments until you've updated, especially ones that ask you to open them quickly.
Check you're still supported. Some older versions no longer get these fixes. If Windows Update says your version has reached end of support, these protections won't arrive.
Why there are so many
The count has jumped two months running. Security researchers link the rise to AI-assisted bug hunting: Dustin Childs of Trend Micro's Zero Day Initiative told Dark Reading that AI is "accelerating bug-hunting on both sides" and "shortening the time between a vulnerability existing and someone noticing it."
That's the other side of the AI security story we've been following, from AI models built for cyber defence to agents finding weaknesses they weren't asked to. More bugs are being found faster, by defenders and attackers alike, and the practical result for everyone else is simple: install updates when they arrive.