This month, **Microsoft** delivered an extraordinary **Patch Tuesday** update, addressing over 1,400 security vulnerabilities in its **Windows** operating systems and other software. This massive release far surpasses previous records, including September's nearly 1,000 fixes, which was already an unusually high number.  Among the weaknesses patched this week, one stands out as a “zero-day” vulnerability, meaning it has already been actively exploited. **CVE-2026-96951** is a security feature bypass in the **Windows Shell**, affecting **Windows 10** and **Windows 11** systems, alongside several **Server** versions. ### Windows 10 Support Extended For **Windows 10** users, there's good news regarding continued security updates. While **Microsoft** initially planned to cease free support in October 2025, a quiet extension now ensures free updates until October 2027, providing an additional year of secure operation. ### Critical Flaws and Public Disclosures At least 78 of this month's fixes are rated “critical,” indicating they can be exploited with minimal user interaction and often allow for arbitrary code execution. While not yet exploited, **CVE-2026-108398**, a security feature bypass in the **.NET Framework**, was publicly disclosed prior to the patch release, potentially giving attackers a head start in developing exploits. **Satnam Narang**, a senior staff research engineer at **Tenable**, highlighted the unprecedented scale of this year's vulnerability discoveries. “We’ve now crossed the 4,000 CVE mark with two months left to go,” he noted, contrasting it with the previous record of 1,261 CVEs patched in 2020. **Microsoft** attributes this surge in bug discovery, and presumably many of the fixes, to large language models and AI. ### Strain on Security Teams However, this deluge of patches presents significant challenges for corporate security teams. Testing individual updates to prevent conflicts with existing software before network-wide deployment is a time-consuming and resource-intensive process. **Tyler Reguly**, associate director of security research and development at **Fortra**, advises security leaders to prioritize patching vulnerabilities listed in the U.S. **Cybersecurity & Infrastructure Security Agency (CISA)**’s “Known Exploited Vulnerabilities” (KEV) catalog. So far this year, only 26 **Microsoft** vulnerabilities have appeared in this critical list. “Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act,” **Reguly** emphasized. For a deeper dive into this month's updates, **Cisco Talos** offers a comprehensive roundup of noteworthy flaws, and the **SANS Internet Storm Center** provides a reliable index of vulnerabilities by severity, CVE number, and affected software.