Windows 11 October updates fix zero-day, VPN failures, and black screens

1 час назад 4

Microsoft released its October 2026 Patch Tuesday updates for Windows 11, addressing 1,413 vulnerabilities.

The update addresses an actively exploited Windows Shell vulnerability, along with VPN connection failures, desktop black screens, and gaming mouse stutter.

The October 13 release also delivers the final monthly security update for Windows 11 24H2 Home and Pro, whose users must upgrade to a supported version to continue receiving security fixes.

KB5127648 covers versions 24H2, 25H2, and 26H2, while KB5127646 updates version 26H1. Both packages incorporate improvements from September’s updates, including the optional preview releases.

Exploited security bypass patched

The most urgent security fix addresses CVE-2026-96951, a Windows Shell command-injection vulnerability that attackers have already exploited to bypass Mark of the Web (MOTW) defenses.

MOTW identifies files originating from the internet, allowing Windows and applications to apply additional security checks. Evading those protections can make malicious files more dangerous when users open them.

Exploitation requires user interaction, such as opening a specially crafted attachment or following an attacker-controlled link delivered through email or instant messaging.

The advisory credits Fujitsu researchers Riku Bamba and Yuya Chudo, Anthropic’s Benoit Sevens using Claude, and a researcher identified as yhw. Microsoft has not disclosed details of the observed attacks.

The broader October security release also fixes CVE-2026-108398, a publicly disclosed .NET Framework vulnerability credited to Google Project Zero’s James Forshaw. An authenticated local attacker could use a crafted .NET assembly to bypass Windows Defender Application Control and execute unauthorized code within a protected process. Microsoft reports no exploitation of this flaw.

Reliability fixes and other issues

Both Windows update packages repair Explorer.exe startup failures and repeated crashes in multi-user environments, including Azure Virtual Desktop and FSLogix, which could leave users facing a black screen after signing in.

They also address Always On VPN failures involving automatic protocol selection or fallback. Affected connections could remain stuck while connecting or fail after an unsuccessful attempt, sometimes reporting that the requested port was already in use.

Other fixes restore tiered Storage Spaces Direct virtual disks that failed to come online and resolve mouse-input stutter in some games. The updates also expand deployment of replacement Secure Boot certificates and enable auditing for ReFS volumes on external storage, while leaving optional enforcement controls disabled.

KB5127648 additionally fixes AC-3 playback, printing failures involving RAW or Generic Text Only drivers, and fingerprint sign-in failures after a cold boot.

However, some USB Audio Class 1.0 devices may still produce no sound, display Code 10 errors, or have unresponsive volume controls. September’s emergency updates resolved the multichannel symptoms, but Microsoft is still working on the remaining problems.

Windows users can install the updates through Settings > Windows Update > Download & install all.