October 2026 Patch Tuesday: update your Windows PC at home

If you have a Windows PC at home, install this month’s updates today. This is not a “wait for the weekend” release.

Microsoft released the October 2026 security updates on October 13, 2026 (October 2026 Security Updates release notes). Secondary reporting from BleepingComputer counted about 1,411 flaws in Microsoft’s Patch Tuesday package alone (their tally excludes many earlier-in-the-month Azure and cloud fixes). BleepingComputer notes that its count leaves out 348 fixes Microsoft shipped earlier in the month. You do not need to reconcile every CVE spreadsheet. You need your PC current, rebooted, and finished installing.

One bug is already exploited in the wild. That is enough reason to stop reading CVE lists and open Windows Update.

If you are still on Windows 11 version 24H2 Home or Pro, October 13 is also the end-of-updates date for those editions. That story is already covered in Windows 11 24H2 Home/Pro: end of updates is October 13. This article is the monthly security train, not a rehash of the version cliff. For last month’s home checklist, see September 2026 Patch Tuesday.

The zero-day that matters at home: CVE-2026-96951

Microsoft’s advisory for CVE-2026-96951 (Windows Shell Security Feature Bypass) is the one to treat as urgent:

• Impact: Security Feature Bypass (command injection in Windows Shell)
• Severity: Important, CVSS 8.8
• Why it matters: BleepingComputer reports it can bypass Mark of the Web protections that normally warn you about files from the internet
• Exploited: Yes (Exploitation Detected)
• Released: October 13, 2026

Mark of the Web is the quiet tag Windows puts on downloads and many email attachments so Explorer, Office, and SmartScreen treat them as untrusted. A MotW bypass means a crafted file can skip the warnings and restrictions you were counting on. Microsoft’s description is blunt: improper neutralization of special elements in a command lets an unauthorized attacker bypass a security feature over a network. Secondary reporting (BleepingComputer) frames this as a MotW bypass tied to Windows Shell command injection. Microsoft has not published a public how-the-attack-worked write-up, and you do not need one. You need the October cumulative update installed.

CISA also added this CVE to its Known Exploited Vulnerabilities catalog on October 13, 2026. That is the federal “this is being used” stamp, not a reason to panic-buy antivirus. Patching is the job.

Also patched, less urgent for most home PCs: CVE-2026-108398

Microsoft also fixed CVE-2026-108398, a .NET Framework security feature bypass that was publicly disclosed (not listed as actively exploited the way CVE-2026-96951 is). Microsoft describes it as an untrusted search path issue that lets an authorized local attacker bypass a security feature, and BleepingComputer reports it can be used to get around Windows Defender Application Control (WDAC) restrictions.

For a typical home PC that is not running enterprise WDAC policy, this is background noise compared with the MotW zero-day. Still, the same October Windows Update package covers it. Install once, reboot once, and you are done with both.

There was a third publicly disclosed item in secondary reporting (MessagePack-CSharp denial of service). It is not why your living-room PC should update today.

Office attachments and previews: stay picky

October’s volume includes a large Office and mail-client cohort in Microsoft’s experimental “risk cohorts” grouping (secondary reporting notes on the order of 135 flaws in Office documents and mail clients). You do not need the full list. You need habits:

• Treat unexpected Word, Excel, PowerPoint, and RTF attachments as hostile until you know the sender and expected the file.
• Do not casually preview weird Office files in Outlook Reading Pane or File Explorer Preview Pane.
• Updating Windows does not always update every Microsoft 365 / desktop Office channel the same way. Open an Office app and let it finish its own updates if it offers them.

This is the same practical advice we gave after September Patch Tuesday. The MotW zero-day makes it sharper this month: do not assume “Windows would have warned me” is enough until you are patched.

Do this on your home PC

1. Open Settings → Windows Update.
2. Click Check for updates.
3. Install everything offered, including any restart-required quality updates.
4. Restart when Windows asks. Leaving the reboot for later leaves the old Shell code running.
5. Open Windows Update again after reboot and confirm there are no pending required updates.
6. If you use Microsoft 365 or desktop Office, open an Office app, check for Office updates, and finish those too.
7. Repeat on every Windows computer you use at home (desktop, laptop, the kid’s machine, the shared living-room PC).

That is the whole job. No special tool required.

Confirm you are current

After reboot, Windows Update should show you are up to date, or only optional items left. If it still lists important quality updates, you are not done.

If updates fail repeatedly, note the error code Windows shows, free some disk space, and try again. A stuck updater is not a reason to stay on an exploited MotW bypass for another week.

What you can skip reading

Longer write-ups dig into server-only pieces, risk-cohort PDFs, and every Critical RCE ID. Those are not why your home PC should update today. Your action list is still: check for updates, install, reboot, confirm. If you are also stuck on unsupported 24H2 Home/Pro, finish that upgrade path separately using the 24H2 end-of-updates guide.

Bottom line

October 13, 2026 delivered a record-volume Patch Tuesday, including an actively exploited Windows Shell Mark of the Web bypass (CVE-2026-96951) plus a publicly disclosed .NET / WDAC bypass that matters less for most home setups (CVE-2026-108398). Cite Microsoft’s October release notes for the official package, and BleepingComputer’s ~1,411 count if you want a secondary tally. On your Windows PC at home: Settings → Windows Update → Check for updates, install, reboot, confirm you are current, and update Office apps if you use them. Treat unexpected Office attachments and previews carefully until you are done.

Image: Windows security “Comprehensive protection built-in” marketing art (microsoft.com/windows/comprehensive-security).