Microsoft Fixed 1,400 Flaws in One Month. Here Is How to Prioritize

Microsoft’s October security update was its largest ever. It fixed more than 1,400 vulnerabilities in one release, and attackers were already exploiting one of them. A month earlier, it had set the previous record.

That is a lot of fixes for a small business to absorb. However, you do not need to apply every one of them on day one. This post shows what to patch first, and a monthly routine that works without a full-time IT team.

What Microsoft fixed in October

Outlets count the release differently, but the totals sit around 1,400 to 1,415 vulnerabilities. Roughly 70 to 78 earn a critical rating, and most of those allow remote code execution. That means an attacker could run code on an affected machine from across a network.

Microsoft also flagged three zero-days. A zero-day is a flaw that is public or exploited before a fix exists. One was under active attack, and two were publicly disclosed.

The flaw that matters most

The exploited flaw is CVE-2026-96951, a bypass in Windows Shell. It defeats Mark of the Web, the feature that warns you before you open a file from the internet. Microsoft and the US cyber agency CISA both confirmed attacks.

Why does that matter? Attackers use bypasses like this to make a malicious file open without the usual warning. That makes phishing emails more dangerous, because the safety prompt your staff rely on may not appear.

The flaw scores 8.8 out of 10 for severity. According to one report, CISA gave federal agencies until October 16 to fix it. That date passed two weeks ago, so if you have not installed the October updates, do it now.

Two more patches this week

Google released Chrome 156 on October 30. Version 156.0.8078.79 fixes 21 security flaws, including one rated critical. Reports say attackers were not exploiting any of them at release. Chrome updates itself, but it often needs a restart to finish.

Separately, Ivanti updated its advisory on October 29 for Connect Secure VPN appliances. Attackers chained three flaws to run commands with root access, steal credentials, and probe internal networks. Ivanti says the attacks hit a limited number of customers, and it has released patches. If you run this VPN, apply them today.

Why you cannot patch everything at once

A record release creates a real problem for a small team. Every update can break something, and every restart costs time. If you try to apply everything immediately, you may skip testing and cause an outage. If you wait too long, you leave doors open for attackers.

Small teams also lose time to surprises. A patch can change a setting, break a printer driver, or slow an older PC. That is why one test machine pays for itself.

The answer is to patch in order of risk, not in order of arrival.

A simple order of priority

Work through these five groups in order.

Flaws that attackers already exploit. Check the CISA list of known exploited vulnerabilities.
Anything facing the internet, such as VPNs, firewalls, routers, and web servers.
Browsers and email apps, because they open content from outsiders.
Systems that hold customer data, money, or logins.
Everything else, on your normal monthly schedule.

Exploited flaws come first because the attack is not theoretical. Internet-facing systems come next because attackers can reach them without tricking anyone. The rest can wait for your regular window, as long as you have one.

Next, write the order down. A one-page checklist stops arguments on patch day, and it helps a new colleague take over.

A monthly routine that works

Pick a fixed patch day, such as the Thursday after Patch Tuesday.
Back up first, and test the update on one machine.
Then roll out to the rest within a few days.
Keep an emergency path for exploited flaws, with a goal of patching within days.
Keep a simple list of every device, its owner, and its software versions.

Patch Tuesday falls on the second Tuesday of each month, so the next one is November 10. Backups matter here as well, as in ransomware backups. If an update goes wrong, you need a way back.

What to do about machines you cannot patch

Some devices no longer receive fixes. Windows 10 PCs without paid extended updates are the common case. We explained why in Windows 10 ESU Year 1 ended. Replace those machines, or isolate them from the internet and from sensitive systems until you can.

The same rule applies to the software under your website. Our post on the October PHP security update shows what happens when a flaw sits in the layer below WordPress. Self-hosted tools need an owner too, as in who patches your automation tool.

FAQ

Do I need to install every Microsoft update right away?

No. Install exploited and critical fixes first, and the rest in your regular window. Test on one machine, and keep a backup.

Is automatic updating safe?

For browsers and most apps, yes. For servers, VPNs, and business-critical software, test first or schedule a window, because a bad update can cause downtime.

How do I know if a flaw is being exploited?

Check the CISA Known Exploited Vulnerabilities list, and also read the vendor notice. Both say when attacks are already happening.

How long should I wait before patching?

For exploited flaws, wait days, not weeks. For everything else, a week or two of testing is reasonable.

What if I have no IT person?

Hand patching to someone who owns it. A named owner and a monthly routine beat a perfect plan that nobody follows.

Getting started

We manage patching for small businesses, including monthly routines, emergency fixes, and device lists. Book a Free Call, and we will check what your devices need today.