Many of today’s breaches do not start with clever malware. They start with someone logging in. This month, Japanese media group Nikkei disclosed its third security incident in about a month: attackers used stolen credentials to reach a development system and exposed about 1.83 million records, around 150,000 of which contained personal details such as names and email addresses. Earlier incidents at the same company involved a hijacked Google Workspace account and a compromised Microsoft 365 account that was used to send spear-phishing emails to staff.

Small businesses use exactly the same platforms, often with default settings left untouched. The good news is that both Microsoft 365 and Google Workspace include strong protections, and most can be switched on by an administrator in an afternoon. This guide walks through the most important steps. You will need an account with administrator rights.

Step 1: Protect the admin accounts first

An attacker who controls an administrator account controls everything, so start here.

1. Use separate admin accounts. Give administrators a dedicated admin login that is not used for daily email or browsing.
2. Keep the number small. Two administrators is usually enough for a small business: one main and one backup, so you are never locked out.
3. Turn on the strongest sign-in method available for those accounts, such as a hardware security key or an authenticator app, before anything else.
4. Store a break-glass account securely: an emergency admin login, with its recovery details written down and kept offline.

Step 2: Enforce multi-factor authentication for everyone

Multi-factor authentication (MFA) means a stolen password alone is not enough to sign in. The key word is enforce: offering MFA as optional leaves gaps.

In Microsoft 365

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com).
2. If you do not have advanced licences, make sure Security defaults are enabled. They require all users to register for MFA and block older, weaker sign-in methods.
3. If your plan includes Conditional Access, create a policy that requires MFA for all users and all cloud apps, and test it on a small group first.

In Google Workspace

1. Sign in to the Google Admin console (admin.google.com).
2. Go to Security, then the 2-Step Verification settings.
3. Allow users to turn on 2-Step Verification, give staff a short enrolment period, and then set enforcement to on.
4. Where possible, restrict methods to security keys or the Google prompt rather than SMS codes.

Tell staff before you enforce MFA, and set a date. A short notice prevents a Monday morning full of lockouts.

Step 3: Close the side doors

Attackers often bypass MFA through older protocols or connected apps.

• Block legacy authentication. Older email protocols such as POP, IMAP and basic SMTP authentication may not support MFA. In Microsoft 365, Security defaults or a Conditional Access policy can block them. In Google Workspace, review the settings for less secure app access and IMAP for users who do not need them.
• Review third-party app access. Staff may have granted outside apps permission to read mail or files. In Microsoft Entra, review Enterprise applications and consider requiring admin approval for new app consents. In the Google Admin console, open Security > Access and data control > API controls to see and restrict connected apps.
• Stop automatic forwarding. Criminals who take over a mailbox often set a rule to copy all mail to an outside address. Disable automatic external forwarding unless there is a business need.

Step 4: Turn on alerts and check sign-in logs

You want to know quickly when something looks wrong.

1. In Microsoft 365, review sign-in logs in the Entra admin center and alert policies in the Microsoft Defender portal (security.microsoft.com). Look for sign-ins from unexpected countries and new inbox rules.
2. In Google Workspace, use Reporting > Audit and investigation for login events, and check Rules for alerts such as suspicious login and user granted admin privilege.
3. Send alerts to a shared mailbox that more than one person checks.
4. Set a recurring 15-minute weekly slot to skim the logs. Regular, small checks catch problems early.

Step 5: Plan for the day a login is stolen

Even with good controls, an account may be compromised. Prepare the response in advance:

• Know how to reset a password and sign the user out of all sessions in your admin console.
• Know how to revoke app tokens and remove suspicious inbox rules.
• Write a one-page checklist listing who to call, including your IT provider and bank, if a mailbox is used for fraud.
• Remove accounts promptly when staff leave, and transfer their data to a manager.

Quick checklist

• Separate, protected admin accounts, kept to a minimum
• MFA enforced for every user, not just offered
• Legacy sign-in blocked and external forwarding disabled
• Third-party app access reviewed
• Alerts on and logs checked weekly
• A written plan for a compromised account

Menu names change from time to time as Microsoft and Google update their consoles, so if a setting has moved, search for it by name inside the admin portal. The steps themselves remain among the most effective defences a small business can put in place.

Sources

• BleepingComputer: Nikkei discloses third data breach in a month, 1.8M records exposed

Featured image: Photo: “UF Norman Office Laptop Desk Workstation” by cdsessums, CC BY 2.0, via Openverse — source

Oracle released its October 2026 Critical Patch Update on Tuesday, 20 October, and it is a very large one. It matters to any organisation that runs Oracle software, from large enterprises using E-Business Suite or WebLogic to small development teams that simply have Java or MySQL somewhere in their stack. This article explains what was fixed, which systems to patch first, and how smaller IT teams can approach a release of this size without getting overwhelmed.

Key takeaways

• The update contains 1,295 security patches addressing 1,209 unique CVEs across 33 Oracle product families.
• According to Tenable’s analysis, 95 CVEs are rated critical and 439 are rated high.
• Hundreds of the fixes address flaws that can be exploited remotely without a username or password.
• Several flaws in Oracle Fusion Middleware, E-Business Suite and JD Edwards carry the maximum CVSS v3 score of 10.0.
• Oracle’s risk matrices do not flag any of the flaws as exploited in the wild, but attackers often study patches quickly, so delay is risky.

What Oracle released

Oracle’s quarterly Critical Patch Update (CPU) is its main vehicle for security fixes. The October 2026 edition, the last quarterly CPU of the year, covers 33 product families, including Oracle Database Server, Java SE, MySQL, E-Business Suite, Fusion Middleware, Enterprise Manager, PeopleSoft and Siebel CRM.

Tenable’s breakdown, published via Security Boulevard, puts the severity split at 95 critical CVEs, 439 high, 582 medium and 93 low. In patch terms, critical fixes make up just under 9 percent of the total, while high-severity fixes account for more than a third.

Where the fixes are concentrated

Two product families take the largest share. Oracle Fusion Middleware, which includes WebLogic Server, SOA Suite and Access Manager, received roughly 200 patches, and E-Business Suite received 194. Other heavily patched families include:

• Siebel CRM, with 122 patches
• Oracle Communications, with 110 patches
• PeopleSoft, with 109 patches
• JD Edwards, with 102 patches
• MySQL, with 98 patches
• Java SE, with 55 patches, most of which are remotely exploitable without authentication

Oracle Database Server received a much smaller set of 13 patches, one of them rated critical.

The most serious flaws

SecurityOnline’s analysis highlights a group of flaws rated 10.0, including issues in the E-Business Suite Workflow Notification Mailer, the Access Manager authentication engine, SOA Suite components and the JD Edwards EnterpriseOne Orchestrator. Several WebLogic Server core flaws are rated 9.8, some reachable over the T3 and IIOP protocols and others over plain HTTP. A 9.8-rated issue in Database Server relates to its bundled OpenSSL component, and Oracle APEX also has a 9.8-rated fix.

The common thread is that many of these flaws are reachable over the network and, in a number of cases, need no login. That is exactly the profile attackers look for in internet-facing business systems.

Why this matters even without known attacks

Oracle’s advisories do not report active exploitation for this batch, and no public proof-of-concept had been confirmed when analysts wrote about the release. That is good news, but it is not a reason to wait. Analysts warn that attackers often reverse-engineer Oracle patches within days of release. SecurityOnline also recalls CVE-2025-61882, an E-Business Suite flaw abused in a 2025 data theft and extortion campaign, as a reminder of how valuable these systems are to criminals.

For Nigerian and African organisations, this is not a distant problem. Oracle ERP, database and middleware products run in many large organisations across the region, and many mid-sized companies use Java-based or MySQL-backed applications built by local vendors. Systems that hold payroll, customer and financial data are prime targets for extortion.

How to prioritise a release this big

No team can apply 1,295 patches at once. A sensible order, based on analysts’ recommendations, looks like this:

1. Internet-facing middleware and ERP first. Patch WebLogic, SOA Suite, Access Manager and E-Business Suite servers that are reachable from the internet.
2. Remote, no-login flaws next. Work through every remaining fix that Oracle’s risk matrices mark as remotely exploitable without authentication.
3. Internal systems in the next maintenance window. Database Server, MySQL and Java SE installations that are not directly exposed can follow, but should not be left for months.

If you cannot patch immediately

• Block T3 and IIOP traffic from untrusted networks, since several WebLogic and SOA Suite flaws use those protocols.
• Keep E-Business Suite and middleware administration consoles off the public internet; put them behind a VPN or restrict them to known IP addresses.
• Increase monitoring of logs on exposed Oracle systems until patches are in place.

Don’t forget the hidden Oracle software

Smaller organisations often do not think of themselves as “Oracle customers”, yet Java runtimes and MySQL databases sit inside many line-of-business applications, accounting tools and websites. Ask your software vendors whether their products bundle Java or MySQL and when they will ship updated builds.

Oracle’s move towards more frequent patching

Alongside the quarterly CPU, Oracle has been publishing monthly Critical Security Patch Update advisories in recent months, and its October announcement encourages customers to adopt a monthly security patching cycle. For many teams that will mean changing how they schedule maintenance windows and test updates. It is worth starting that conversation now rather than when the next large release arrives.

What you should do

• Identify every Oracle product you run, including Java and MySQL embedded in third-party applications.
• Read Oracle’s October 2026 advisory and its risk matrices for the products you use.
• Patch internet-facing WebLogic, SOA Suite, Access Manager and E-Business Suite systems first.
• Apply temporary network restrictions where patching must wait.
• Review your patch process so you can handle Oracle’s monthly security updates in future.

Sources

• Oracle Security Blog: October 2026 Critical Patch Update Released
• Security Boulevard (Tenable): Oracle October 2026 CPU Addresses 1209 CVEs
• SecurityOnline: Oracle Critical Patch Update October 2026
• Oracle Critical Patch Update Advisory – October 2026

Featured image: Photo: “17° Server Room @ Work” by Leonardo Rizzi, CC BY-SA 2.0, via Openverse — source

Most small business websites run on PHP, the programming language behind WordPress and many other platforms. Yet few owners know which PHP version their site uses, or that old versions stop receiving security fixes. With PHP shipping an urgent security release on 21 October 2026 and PHP 8.2 reaching the end of its security support on 31 December 2026, now is a good time to check. This step-by-step guide is for business owners, office managers and junior web admins using shared hosting with cPanel, or a WordPress site. You do not need to be a developer to follow it.

Key takeaways

• You can see your PHP version in WordPress under Tools > Site Health > Info > Server, or in cPanel’s MultiPHP Manager.
• As of October 2026, php.net lists PHP 8.2, 8.3, 8.4 and 8.5 as supported. Anything older gets no security fixes.
• Always back up your files and database before changing PHP versions.
• Test on a staging copy first if your host provides one, then switch the live site.
• If something breaks, switch back temporarily, but only to a version that still receives security updates.

Why your PHP version matters

Each PHP branch gets a period of active support, followed by a period where it receives only security fixes, and then nothing at all. According to php.net’s supported versions page, as of 21 October 2026:

• PHP 8.5: active support until 31 December 2027, security fixes until 31 December 2029.
• PHP 8.4: active support until 31 December 2026, security fixes until 31 December 2028.
• PHP 8.3: security fixes only, until 31 December 2027.
• PHP 8.2: security fixes only, ending 31 December 2026.

A site on PHP 7.4, 8.0 or 8.1 will not get patches for newly discovered flaws, including critical ones.

Before you start: prerequisites

• Your hosting control panel login (often cPanel) or your WordPress administrator login.
• A recent, complete backup that includes both the site files and the database.
• A list of the plugins and theme your site uses.
• About an hour at a quiet time for your business, such as late evening or a weekend morning.
• Your host’s support contact, in case your plan does not let you change PHP yourself.

Step-by-step: check your current PHP version

Option A: inside WordPress

1. Log in to your WordPress dashboard as an administrator.
2. Go to Tools > Site Health. On the Status tab, look for a recommended improvement about PHP; WordPress flags outdated versions here.
3. Click the Info tab, then expand the Server section. The PHP version is listed there.
4. Write the version down.

Option B: in cPanel

1. Log in to cPanel.
2. In the Software section, open MultiPHP Manager. If you cannot see it, your host may have disabled it, so contact support.
3. Find your domain in the list. The PHP version assigned to it is shown alongside. If it says inherit, the site uses the server’s default PHP version.

Step-by-step: update PHP safely

Step 1: Back up everything

Copy all of your site files and export your database. A backup is only useful if it includes both. Many hosts offer a one-click backup tool in cPanel, and WordPress users can use a backup plugin such as Duplicator. Download a copy to your computer or cloud storage, not just to the same server.

Step 2: Check plugin and theme compatibility

Visit each plugin’s page in the WordPress plugin directory and check the PHP version it supports. Update all plugins, themes and WordPress itself to their latest versions before changing PHP, because updates often add support for newer PHP releases. Plugins that have not been updated in years are a warning sign; plan to replace them.

Step 3: Test on a staging copy

If your host offers a staging site, create one so it matches your live site, then change PHP on the staging copy only. If no staging option exists, choose a quiet time and be ready to switch back.

Step 4: Change the PHP version in cPanel

1. Open MultiPHP Manager.
2. Tick the checkbox next to the domain you want to change.
3. Choose the new version from the PHP Version drop-down menu. Versions your host recommends are labelled Recommended.
4. Click Apply. If PHP-FPM is enabled for the domain, it updates to match automatically.

A good target for most sites today is PHP 8.3 or 8.4. If a version is missing from the list, it is not installed on your server or not available on your plan; ask your host.

Step 5: Test the important things

Open your site in a private browser window and test what matters to your business: the home page, navigation, contact and enquiry forms, newsletter sign-up, comments, logins and, for online shops, the full checkout process.

Step 6: Apply to the live site

Once staging works, make the same change on the live site, then repeat your tests.

Troubleshooting

The site shows a blank page or “critical error”

Switch back in MultiPHP Manager to the previous version so customers are not affected, then investigate on staging. Only roll back to a version that still receives security updates.

Finding which plugin is the problem

On a staging site, set WP_DEBUG to true in the wp-config.php file to display PHP errors and deprecated function warnings. Error messages usually name the plugin or theme folder causing trouble. Update it, replace it with a maintained alternative, or ask its developer for a fix. Turn debugging off again afterwards.

You cannot change the version yourself

Some shared hosting plans restrict PHP changes. Open a support ticket and ask the host to move your domain to a supported version, or ask about moving to a plan that allows it.

Checklist

• Current PHP version noted.
• Full backup of files and database saved off the server.
• WordPress core, plugins and theme updated.
• Plugin compatibility checked; abandoned plugins listed for replacement.
• PHP changed on staging and tested.
• PHP changed on the live site and key functions tested.
• Debug mode switched off.
• Calendar reminder set to check PHP and plugin updates every month.

Next steps

Keeping PHP current is not a one-time task. Ask your host to confirm how quickly they apply PHP security releases, such as the critical update scheduled for 21 October 2026, and add a monthly website health check to your routine. If you rely on an outside developer, ask them to confirm the PHP version in writing and to plan upgrades well before each branch reaches its end of support.

Sources

• cPanel Docs: MultiPHP Manager for cPanel
• PHP: Supported Versions
• WPMU DEV: How to Update PHP to the Suggested WordPress Version

If your office PCs or personal laptop run Windows 11 Home or Pro, there is one update you should not put off. Windows 11 version 24H2 Home and Pro editions reached end of support on 13 October 2026, the same day as Microsoft’s October Patch Tuesday. That release was the last scheduled monthly security update for those editions.

A PC on 24H2 will not stop working. It will boot, open your files and run your apps as before. What changes is that Microsoft no longer sends it security fixes, bug fixes or time zone updates, and it is no longer covered by technical support. Every month from now on, newly discovered vulnerabilities will stay open on those machines, which is exactly the kind of gap attackers look for.

The fix is usually simple and free. This guide walks you through it.

Who is affected

• Windows 11 Home and Pro, version 24H2: support ended on 13 October 2026. These devices need to upgrade.
• Windows 11 Enterprise and Education, version 24H2: supported until 12 October 2027, following Microsoft’s usual extra year for these editions.
• Windows 11 version 25H2: still supported and receiving monthly updates.
• Windows 11 version 26H2: Microsoft’s latest annual feature update, released on 29 September 2026.

Because 24H2, 25H2 and 26H2 share the same underlying foundation, moving between them is far less disruptive than older Windows upgrades. For PCs already on 25H2, the move to 26H2 arrives as a small enablement package that installs much like a normal monthly update.

Step 1: Check which version you are running

1. Press Windows key + I to open Settings.
2. Select System, then scroll down and select About.
3. Under Windows specifications, look at Edition (Home, Pro, Enterprise and so on) and Version (24H2, 25H2 or 26H2).

A faster alternative is to press Windows key + R, type winver and press Enter. A small window shows the version number.

If you manage several computers, record the edition and version for each one in a simple spreadsheet so you know which machines still need attention.

Step 2: Prepare the PC

Feature updates are generally reliable, but a few minutes of preparation prevents most problems:

1. Back up important files. Copy documents, accounting data and photos to an external drive or a cloud service such as OneDrive. For business data, confirm the backup actually opens.
2. Plug in the power. Connect laptops to the charger, and if your area has unstable power, run desktops from a UPS during the update.
3. Check free space. Go to Settings, then System, then Storage. Clear out downloads and temporary files if the drive is nearly full.
4. Install pending updates first. Make sure the PC has all current monthly updates before the version upgrade.
5. Note key software. If you rely on specialist software such as accounting, POS or industry applications, check with the vendor that it supports the newer Windows version.

Step 3: Upgrade through Windows Update

1. Open Settings and select Windows Update.
2. Turn on Get the latest updates as soon as they’re available.
3. Select Check for updates.
4. When the feature update to a newer Windows 11 version appears, select Download and install.
5. Save your work and restart when prompted. The PC may restart more than once.

The offer can take a little time to appear on some devices, because Microsoft rolls updates out gradually and may hold them back where a known compatibility issue exists. PCWorld notes that some users have reported known issues with 26H2, so if the newest version is not offered, moving to 25H2 is a perfectly good choice: it is supported and keeps receiving monthly security updates.

Step 4: Confirm it worked

1. Go back to Settings, then System, then About, and confirm the new version number.
2. Open Windows Update again and install anything else it offers.
3. Open your main business apps and check that printers, scanners and network drives still work.
4. Update your device list with the new version and the date.

If something goes wrong

• Update fails or stalls: restart the PC, make sure you have enough free storage and a stable internet connection, then try again. If it still fails, search Settings for the Windows Update troubleshooter or ask your IT support.
• A problem appears after upgrading: Windows usually lets you go back for a short period under Settings, then System, then Recovery. Remember that going back to 24H2 leaves you unsupported, so treat it only as a temporary step while you fix the issue.
• Many PCs to manage: consider asking your IT provider to manage feature updates centrally so no device is left behind.

Do not forget Office

October 13 was also the end of support for Office LTSC 2021, Visio LTSC 2021 and Project LTSC 2021. If your business bought these perpetual-licence versions, plan a move to a supported version of Office so that your documents and email software keep receiving security fixes too.

Sources

• PCWorld: Still on Windows 11 24H2? You have one week to upgrade
• Pureinfotech: Windows 11 24H2 gets its final update on October 13 as version 26H2 takes over

Featured image: Photo: “The New Study” by KevinJump, CC BY 2.0, via Openverse — source

Millions of computers in homes and small offices still run Windows 10, a full year after Microsoft ended mainstream support on 14 October 2025. Many of them are still safe to use, but only because they are enrolled in Microsoft’s Extended Security Updates (ESU) programme. Many others are quietly unprotected.

Microsoft has extended the consumer ESU programme so that eligible personal devices keep receiving security fixes through 12 October 2027, a year longer than originally planned. On 13 October 2026, it released the latest ESU update, KB5126657. This guide shows you how to confirm your PC is covered and fully up to date.

Who qualifies for consumer ESU

The consumer programme is for personal-use devices. According to Microsoft’s updated documentation, as reported by BleepingComputer:

• Computers joined to an Active Directory domain or managed through mobile device management (MDM) are not eligible for the consumer programme.
• Personal devices that are only registered with Microsoft Entra (for example, a work account added to a home PC) still qualify.
• Devices already enrolled are covered automatically until the new end date, with nothing extra to do.
• One ESU licence can cover up to 10 devices tied to the same Microsoft account.

There are several ways to enrol: sync your PC settings to a Microsoft account using Windows Backup (free), redeem 1,000 Microsoft Rewards points, or make a one-time payment of $30. In the European Economic Area, signing in with a Microsoft account is enough.

Businesses with managed PCs need Microsoft’s commercial ESU instead. BleepingComputer reports this can run for up to three years at a total of $427 per device, so it is worth comparing that cost with replacing or upgrading the machine.

Step 1: Check your Windows 10 version

1. Press the Windows key + R, type winver and press Enter.
2. Check the version and build number. ESU updates are delivered to Windows 10 version 22H2.
3. If you see an older version such as 21H2 on a Home or Pro edition, install the 22H2 feature update first through Windows Update.

Step 2: Check ESU enrolment

1. Open Settings and go to Update & Security, then Windows Update.
2. If your PC is eligible but not enrolled, you should see an option to enrol in Extended Security Updates. Select it and follow the prompts to choose an enrolment method.
3. If you choose the free Windows Backup route, make sure you are signed in with a Microsoft account and allow settings to sync.
4. Once enrolled, the Windows Update page should indicate that your device is enrolled in Extended Security Updates.

If you do not see any enrolment option, check that your PC is on version 22H2, that all earlier updates are installed, and that you are signed in with an administrator account.

Step 3: Install the October 2026 update

1. On the Windows Update page, select Check for updates.
2. Download and install KB5126657, then restart when prompted.
3. Run winver again. After the update, Windows 10 22H2 should show build 19045.7807.

KB5126657 includes the October 2026 Patch Tuesday security fixes. It also fixes a File History bug that could show a false “Reconnect your drive” message during backups to external or network drives, and continues the rollout of updated Secure Boot certificates.

A known issue to watch

BleepingComputer notes that some USB Audio Class 1.0 devices, such as certain USB headsets and sound adapters, have had problems since the September 2026 updates, including Code 10 errors or no sound. Microsoft has partly fixed this, but some issues remain. If an audio device stops working after updating, check Microsoft’s release health page before uninstalling security updates.

Step 4: Plan your next move

ESU buys time; it is not a long-term solution. It delivers security fixes only, not new features. Use the extra year wisely:

• Check Windows 11 compatibility with the PC Health Check app. If your PC qualifies, schedule the free upgrade at a quiet time and back up first.
• Budget for replacements if older machines cannot run Windows 11. Spreading purchases across the next 12 months is easier than replacing everything at once.
• Keep your apps updated. Browsers, office software and antivirus tools may stop supporting Windows 10 on their own timelines.
• Keep a register of every Windows 10 PC in your office, its ESU status and its planned replacement date.

Quick checklist

• Windows 10 version 22H2 installed
• ESU enrolment confirmed on the Windows Update page
• KB5126657 installed, build 19045.7807
• Backups working and tested
• Upgrade or replacement plan dated before October 2027

Fifteen minutes per PC is all it takes to know you are covered. An unpatched Windows 10 machine on your network is a risk to every other device connected to it.

Sources

• Microsoft quietly extends free Windows 10 ESU support to October 2027 – BleepingComputer
• Microsoft releases Windows 10 KB5126657 extended security update – BleepingComputer
• Microsoft extends free Windows 10 security updates for a second year – Tom’s Hardware

Microsoft’s October 2026 Patch Tuesday, released on 13 October, is the biggest monthly security update the company has ever shipped. Security researchers who track the release counted well over 1,400 fixed vulnerabilities across Windows, Office, SharePoint, SQL Server, Exchange Server, Azure and developer tools. Exact totals differ slightly between trackers (figures between roughly 1,411 and 1,416 have been published, depending on what each counts), but every analysis agrees on the headline: this is a very large update and it contains at least one flaw that attackers are already using.

For small businesses and home users, the size of the release matters less than one practical question: which machines do you need to update, and how quickly? This article explains what is in the update, which items deserve the most attention, and what you should do this week.

The zero-day you should patch first

The most urgent item is CVE-2026-96951, a security feature bypass in the Windows Shell. According to analyses of the release, the flaw lets attackers get around Mark of the Web, the Windows protection that tags files downloaded from the internet so that Office, SmartScreen and other tools treat them with extra caution. When that tag is bypassed, a malicious file sent by email or downloaded from a website can open without the usual warnings.

Microsoft has marked this vulnerability as exploited in the wild, and the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalogue, giving US federal agencies a deadline of 16 October to patch. That deadline applies to US government networks only, but it is a useful signal: if a national cyber agency wants it fixed within days, businesses everywhere should treat it the same way.

Two other issues were reported as publicly disclosed before a fix was available:

• CVE-2026-108398, a .NET Framework security feature bypass that, according to Windows Report, can let an authenticated attacker get around Windows Defender Application Control (WDAC).
• CVE-2026-92707, a denial-of-service issue in the MessagePack-CSharp library caused by uncontrolled memory allocation.

Publicly disclosed does not mean exploited, but it does mean the details are already out there, which shortens the time before criminals try to use them.

Where the rest of the fixes landed

Qualys’ breakdown shows Windows accounts for the overwhelming majority of the fixes, with Office, developer tools, SharePoint Server, SQL Server, Azure and Exchange Server making up most of the remainder. Around 70 to 78 of the flaws are rated Critical, depending on the tracker, and most of those are remote code execution bugs, the type that can let an attacker run their own programs on a target system.

Several critical items stand out for organisations that run their own servers:

• Exchange Server remote code execution (CVE-2026-70571). On-premises Exchange servers are a long-standing favourite target, so update them promptly.
• Windows QUIC remote code execution (CVE-2026-105016), relevant to systems handling modern network traffic.
• Active Directory Federation Services spoofing (CVE-2026-108131), important for organisations that use AD FS for sign-in.
• Hyper-V remote code execution (CVE-2026-102214), important for anyone running virtual machines on Windows servers.

Reporting on the release links the unusually high number of fixes to Microsoft’s growing use of AI tools to hunt for weaknesses in its own code. Whatever the cause, larger releases put more strain on IT teams, so it helps to have a clear order of work rather than trying to do everything at once.

Android’s October bulletin

Google’s Android security bulletin for October 2026 fixes 25 vulnerabilities in the Framework and System components, with the 2026-10-01 patch level. SecurityWeek reports that seven of them are rated critical, and the most severe is a System flaw that could allow local elevation of privilege without any user interaction. Google did not report any of these bugs as exploited. Pixel phones received a separate set of fixes, including three critical issues.

Android updates reach phones at different speeds depending on the manufacturer and the carrier, so the only reliable check is the security patch level shown on your own device.

Two end-of-support dates that came with this update

October’s Patch Tuesday was also the last scheduled security update for Windows 11 version 24H2 Home and Pro editions, which reached end of support on 13 October 2026. Office LTSC 2021, Visio LTSC 2021 and Project LTSC 2021 also reached end of support on the same date. Devices still running these versions will keep working, but they will no longer receive security fixes, so plan upgrades now rather than after a problem appears.

What you should do

1. Update Windows PCs this week. Open Settings, go to Windows Update, select Check for updates, install everything offered and restart. A pending restart means the fix is not yet active.
2. Prioritise servers. Patch Exchange, SharePoint, Hyper-V hosts and AD FS servers first, after a quick backup.
3. Be extra careful with downloaded files until every machine is patched, since the exploited bug weakens download warnings.
4. Check Android phones. Go to Settings, then About phone or Security, and confirm the patch level is 2026-10-01 or later. Install any waiting system update.
5. Move off unsupported software. Upgrade PCs still on Windows 11 24H2 Home or Pro to a supported version, and plan replacements for Office LTSC 2021.
6. Keep a simple patch log listing each device, the date it was updated and anything that failed, so nothing slips through.

Sources

• Qualys: Microsoft Patch Tuesday, October 2026 Security Update Review
• Windows Report: Microsoft October 2026 Patch Tuesday tackles 1,411 flaws, including 3 zero-days
• SecurityWeek: Android’s October 2026 Updates Patch 25 Vulnerabilities

Featured image: Photo: “My first 5 minute attempt at a transparent screen” by plindberg, CC BY 2.0, via Openverse — source

Security reviews often sound expensive, but one of the best controls is already part of normal development: asking a colleague to read your change before it ships. A good code review catches mistakes that tests miss and spreads knowledge across the team.

What reviewers should look for

Focus on how data enters and leaves the code. Unvalidated input, database queries built from strings, secrets committed to the repository, missing permission checks and overly detailed error messages are common sources of vulnerabilities.

Keep reviews small and regular

Large changes hide problems. Aim for focused submissions that a reviewer can read in under half an hour, and agree a quick turnaround so reviews never become a bottleneck.

• Use a short checklist for authentication, input handling and logging
• Run linters, tests and dependency scanners automatically first
• Require at least one approval before merging to the main branch
• Never approve what you do not understand; ask questions instead

Build a learning culture

Reviews work best when comments are kind, specific and explain the why. Juniors learn faster and seniors catch blind spots. Over time the checklist grows from real findings, which makes every review sharper.

Key takeaway: small, regular, well-supported code reviews prevent more security problems than most tools alone.

APIs power mobile apps, websites and partner integrations, which also makes them a favorite target. Many API breaches come not from clever hacking but from basic gaps in who is allowed to do what.

Authenticate and authorize every request

Authentication proves who is calling. Authorization decides what that caller may touch. A frequent flaw is checking the first but not the second, so one user can read another user’s records by changing an ID in the request. Check ownership on the server for every object.

Validate everything and limit the damage

Treat all input as untrusted. Validate type, length and format, and reject what you do not expect. Add rate limits and sensible timeouts so a single client cannot overwhelm the service or guess credentials endlessly.

• Use short-lived access tokens and rotate keys regularly
• Return only the fields the client needs, never whole database rows
• Send errors that help developers without revealing internals
• Log access attempts without storing passwords or tokens

Manage versions and test

Keep an inventory of every endpoint, including old versions, and retire them on a published schedule. Test regularly with tools that probe for broken access control and excessive data exposure.

Key takeaway: assume every request is hostile until the server has verified who sent it and what they may do.