Microsoft’s October security updates, released on 13 October (US time), are the largest it has ever shipped. Depending on who is counting, the release fixes between 1,411 and 1,413 security flaws, and one of them is already being used by attackers.
What was fixed
According to The Hacker News, the bulk of the fixes are in Windows itself (1,102), with 134 in Microsoft Office, 36 in SharePoint Server and 22 in SQL Server. Most are flaws that could let an attacker gain more control over a computer than they should have, or run their own code on it.
The one that matters most is a bug in the Windows Shell, the part of Windows that runs the desktop and File Explorer. Microsoft says it has been exploited in real attacks. Two other flaws had already been publicly disclosed before a fix was available, which gives attackers a head start.
Malwarebytes notes that Microsoft has said its growing use of AI to find security bugs means we should expect bigger monthly updates from here on. In other words, record months are likely to become normal, and falling a month behind will matter more than it used to.
What to do this week
- Update every Windows PC. Open Start, then Settings, then Windows Update, and click Check for updates. Restart when asked – many fixes do not take effect until you do.
- Do not forget Office. Office fixes usually arrive through Windows Update or the Office apps themselves. Check both.
- Servers count too. If you run your own SharePoint or SQL Server, those need patching as well, ideally after a backup.
- Check, do not assume. A PC that has been off, travelling or stuck on a failed update can quietly miss a month. Someone should confirm every machine actually installed it.
For a small business, the risk is rarely the one famous bug. It is the laptop in the back office that has not updated since winter. A short, regular check of which devices are up to date closes most of that gap.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.