Microsoft October Patch Tuesday: 1,453 fixes, one shell bypass under active exploitation
Microsoft released its October 2026 security updates, addressing 1,453 vulnerabilities across Windows, Office, SQL Server, Exchange, and more. Microsoft flags the Windows Shell Security Feature Bypass (CVE-2026-96951) as "Exploitation Detected," making it the one to prioritize first, along with the publicly disclosed .NET Framework bypass (CVE-2026-108398). Apply the October cumulative updates, and test the shell-bypass fix on a pilot before rolling it out fleet-wide.
Source: https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct
CISA adds six actively exploited vulnerabilities, headlined by a Plex chain
CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on October 20, based on evidence of active exploitation. Four of them form a chainable set in Plex Media Server (CVE-2026-96652, -96654, -96655, -96656) that can be combined toward arbitrary code execution, alongside an OS command injection in EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931) and a DLL search-path flaw in Siemens Software Center (CVE-2026-110936). Move to the vendor fixes — Plex 1.43.3.10861 for the Plex set — and prioritize any internet-exposed instances.
Palo Alto refreshes active-exploitation brief for a PAN-OS GlobalProtect auth bypass
Palo Alto Networks updated its threat brief on October 20 for CVE-2026-0257, an authentication bypass in the PAN-OS GlobalProtect portal and gateway that lets an unauthenticated attacker forge an authentication-override cookie and establish a VPN session (rated CVSS 7.8). The flaw is already under active exploitation and was added to CISA's KEV catalog. If you run GlobalProtect with the override-cookie feature and a shared certificate, disable the override or use a dedicated certificate, and upgrade to a fixed PAN-OS release.
Source: https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
Apache publishes CVE records for flaws already fixed in Tomcat
Apache published NVD CVE records on October 20 for a set of flaws fixed in the Tomcat 11.0.27, 10.1.61, and 9.0.123 releases of October 12. Among them are an HTTP/2 request/response mixup affecting asynchronous servlets (CVE-2026-101356) and an HTTP/2 trailer-header cross-contamination between requests (CVE-2026-88041). If you run an affected 11.x, 10.1.x, or 9.0.x build, upgrade to the corresponding fixed release.