Todd Schell, a senior product manager at Ivanti, wrote on Nov. 6 that Microsoft resolved a record 1,407 unique CVEs in its October Patch Tuesday release, 78 of them rated Critical. Browser updates come next. Google began an early stable rollout of Chrome 158 on Nov. 4, and Mozilla’s schedule has Firefox 160 shipping on Nov. 10. Published tallies of the October release vary a little by outlet, but every count reviewed calls it the largest month Microsoft has shipped.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
Inside that total sits CVE-2026-96951, a Windows Shell flaw that bypasses Mark of the Web protections and was confirmed exploited as a zero-day. October also left loose ends that Schell expects the November cumulative update to close, among them Always On VPN connection failures introduced with the September updates and a Smart App Control setting grayed out on Windows 11 24H2 and later.
October’s 1,407 CVEs and the counts that disagree
The Help Net Security Patch Tuesday forecast puts the record at 1,407 unique CVEs. IT-Connect reports the same number and says it topped September’s 973 by more than 400. It breaks the total down by product: Windows 1,115, Office 138, SharePoint Server 36, SQL Server 22 and Exchange Server 6. Those add up to 1,317, which leaves about 90 unassigned in the article. Other published tallies ran as high as 1,416, so the exact figure depends on how an outlet counts. IT-Connect adds that October was the last update for Windows 11 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016, that Windows Server 2012 and 2012 R2 are in the final year of Extended Security Updates, and that Windows 11 23H2 Enterprise, Education and IoT Enterprise stop receiving security updates in November.
Critical counts diverge more. Schell gives 78, while IT-Connect reports 69 in wording that leaves unclear whether the figure covers all 1,407 or only the 314 remote code execution flaws it tallies. Help Net Security’s Zeljka Zorz, in an Oct. 14 report, added that 55 wormable, zero-click flaws were fixed in components such as DHCP Server, Remote Desktop Gateway and Network Policy Server. IT-Connect credits the rising volume to Microsoft’s use of AI to search for vulnerabilities, though it offers no data to confirm the cause.
Zero-days, PHP2Shell and the emergency fixes
IT-Connect counts three zero-days in the October release: the exploited Shell flaw, a .NET Framework bypass of Windows Defender Application Control that needs local access, and a MessagePack-CSharp denial-of-service bug rated 5.3. Schell’s forecast also covers fixes that landed outside the regular cycle. A Brotli flaw nicknamed Node2Shell, CVE-2026-111497, was fixed on Oct. 25 in .NET 8, 9 and 10 and in .NET 11 Release Candidate 3, with proof-of-concept code public but no known exploitation. On Oct. 26 Microsoft removed seven certificates from the Windows trust list, six eMudhra G3 roots and one AAA Certificate Services cross-sign, because their keys had been compromised.
The PHP2Shell pair is the sharpest example of patching that goes beyond a monthly update. The PHP project’s Oct. 21 security release fixed two critical, unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Schell says exploitation was detected several days before the patches shipped and is still expanding, and that a full fix means replacing the PHP runtime, stopping the web server and restarting it, since old code stays in memory otherwise.
Chrome 158 early stable and Firefox 160 on Nov. 10
Google’s Chrome Releases blog posted on Wednesday, Nov. 4, an Early Stable Update for Desktop with version 158.0.8127.18/.19 for Windows, offered to a small percentage of users, with Mac builds promised shortly. Chrome 158 entered beta on Oct. 28, according to the Chrome developers’ beta post, which gives no stable date. Schell expects a broader Chrome update to follow the early release.
Mozilla’s release calendar shows Firefox 160 shipping at 14:00 UTC on Nov. 10 with an initial 25% rollout, and the iOS build arriving on Nov. 9 with a phased rollout. Schell anticipates ESR updates for select CVEs alongside Firefox and Thunderbird 160. His forecast also expects Adobe updates for Acrobat and Reader, InCopy, InDesign and Premiere, and no Apple updates next week.
Apple’s October fixes and a 2014 app that kept updating
Schell also tracks Apple’s Oct. 26 security releases. macOS Golden Gate 27 addressed 183 unique CVEs, and iOS 18.7.11 and iPadOS 18.7.11 received a backported fix for CVE-2026-86950, a CoreGraphics flaw that could lead to arbitrary code execution and that Apple described as possibly exploited in an extremely sophisticated attack. His other example of old software biting is an abandoned 2014 application still running and self-updating on 2.5 million Windows devices and 300,000 Macs, with several of its update domains open for new registration. The software was detected and removed before any exploitation.
Whether November breaks the record is the open question. Schell expects high CVE counts across Microsoft’s product lines on Nov. 10, and no figure is published yet.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
- The FTC says Lens.com doubled the price shoppers saw in Google ads
- Common allergy, bladder and sleep pills tied to sharply higher dementia odds
- NOAA now gives this winter a 75% chance of the strongest El Nino since 1950
