Microsoft's October security update is the biggest monthly batch the company has ever shipped, and buried in the pile is a Windows bug attackers are already using. CVE-2026-96951 lets someone bypass the Mark of the Web warning that normally flags files downloaded from the internet.

Photo: Jiaqian AirplaneFan / Wikimedia Commons (CC BY 3.0), cropped