Update this weekWindowsPhones & computers

A Windows flaw lets booby-trapped files skip the “Are you sure?” warning

Vendor says: “Microsoft's security update guide marks this vulnerability "Exploited: Yes."” (Microsoft)
Who's affected: Windows PCs.
Under attack?: Yes. Attackers send a crafted file by email or chat. It only works if someone opens it.
What to do: Open Settings, go to Windows Update, select Check for updates, then install and restart. October was also the last update for Windows 11 24H2 Home and Pro, so upgrade if you're on that version.
Fixed in: October 2026 security update
CISA deadline: Federal agencies must fix this by Oct 16, 2026. Everyone else should treat that as a ceiling, not a target.

CVE-2026-96951Severity score 8.8/10Chance of attack in 30 days: 10% (EPSS)Listed Oct 13, 2026Source: Malwarebytes ↗, BleepingComputer ↗

Client notice ready to send

Fill in the bracketed parts, then paste into an email to your clients or team.

Subject: Security update: Windows

Hi [Client name],

Attackers are actively exploiting a security flaw in Windows.

Who's affected: Windows PCs.

What we're doing: [We're checking your systems now and will have the fix in place by DATE.]

What to do: Open Settings, go to Windows Update, select Check for updates, then install and restart. October was also the last update for Windows 11 24H2 Home and Pro, so upgrade if you're on that version.

Fixed in: October 2026 security update
Reference: CVE-2026-96951 – https://www.malwarebytes.com/blog/bugs/2026/10/update-windows-record-patch-tuesday-fixes-flaw-already-under-attack

We'll confirm once everything is updated. Reply here with any questions.

[Your name]

A Windows flaw lets booby-trapped files skip the “Are you sure?” warning

Also under attack in Phones & computers