Today is Patch Tuesday, and it's a big one. Not "a few more than usual" big. Record big.
Microsoft's October 2026 update addresses 1,411 flaws, including one actively exploited and two publicly disclosed zero-days, with 70 rated Critical [1]. That count excludes another 348 fixed earlier in the month [1]. BleepingComputer notes the record comes as Microsoft keeps using AI platforms to find and fix vulnerabilities in its products [1].
Also today: end of support
Windows 11 version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016, reached end of updates today; this is their last security update [1]. Microsoft also said organizations on Windows 11 23H2 Enterprise, Education and IoT Enterprise should upgrade, because security updates stop next month [1].
If any of those are on your network, they just became your new favorite project.
Meanwhile, at the VPN
Ivanti warned that a zero-day in its Connect Secure VPN appliances, CVE-2026-104935, was exploited in the wild [2]. Volexity found an actor chaining three zero-days for unauthenticated root-level code execution on a fully patched appliance, with exploitation starting October 3 [2]. Two are patched; a privilege escalation flaw is still unpatched while Ivanti works on a fix [2]. The attackers went after credentials, Active Directory data, LAPS passwords and BitLocker recovery keys [2].
"Fully patched" doing a lot of work in that sentence.
The new math
AI is finding bugs faster than ever. That's good: every bug Microsoft fixes is one an attacker can't use. But it shifts the pressure to the rest of us. The bottleneck is no longer discovery. It's deployment.
What I'd do this week
- Patch on a schedule you actually keep. Test rings, then broad rollout, measured in days.
- Hunt down end-of-support Windows. Upgrade or isolate.
- Edge devices first. VPNs and gateways are the front door; check vendor advisories today and watch for the remaining Ivanti fix [2].
- Assume patched isn't the same as safe. Monitor edge appliances for odd logins and config pulls.
Patching isn't exciting. It is, however, cheaper than the alternative. Every single time.
For the folks who sign off on budgets
Patching is a staffing and process problem far more than a tools problem. If your team is drowning, the answer is usually automation for routine updates plus a clear policy on what gets an emergency window. AI is going to keep finding more bugs. Budget for the people and processes that turn fixes into installed fixes.