Windows Fixes an Exploited Bypass, Plus 3 Stories
October’s Windows security update deserves attention, but not because this month’s vulnerability total is enormous. Different security firms are counting the release differently, which is exactly why I don’t want to turn a four-digit number into a panic button. One actively exploited flaw matters more: it can weaken the warning system Windows uses to identify files that came from the internet.
Windows closes an exploited download-warning bypass
The flaw, tracked as CVE-2026-96951, affects Windows Shell and can bypass Mark of the Web. Mark of the Web is metadata Windows attaches to an internet download. SmartScreen can use it to warn before an unfamiliar program runs, and Microsoft Office can use it to open a downloaded document in Protected View. Think of it as a shipping label that says, “This package came from outside.” The label doesn’t prove the contents are dangerous, but removing it makes the package look more familiar than it is.
Microsoft says attackers have already exploited the vulnerability. The public record does not explain who is using it or how the attacks are being delivered, so that uncertainty deserves a boundary around it. The vulnerability does require user interaction. It does not mean an unpatched computer will compromise itself while sitting idle, and the bypass is not a replacement for the malicious file or other code an attacker wants someone to open. What it can do is remove one of the useful speed bumps between a deceptive download and a bad decision.
For home users, install the October Windows security update and restart when prompted. For businesses, confirm that managed devices actually completed the update rather than assuming an update policy did the work. Microsoft’s new experimental “risk cohorts” may help large IT teams group this month’s unusually large release by exposure, but Microsoft explicitly says those groupings do not replace checking active exploitation and product-specific guidance.
One more wrinkle: Windows 11 24H2 Home and Pro reached the end of support with this release. As I explained in Monday’s Daily Brief, installing this update does not buy those editions another year of routine security fixes. They also need a supported Windows version.
Technology is rarely just about the technology
Some of the most important technology stories aren’t product launches at all. They’re about health, privacy, education, law, accessibility, work, and what happens when technology reaches ordinary people. Browse more Raymond Tec News for the stories worth understanding without the hype.
A VHS-era privacy law reaches the tracking-pixel web
The Supreme Court hears arguments Wednesday in Salazar v. Paramount Global, a case about a 1988 law written after a reporter obtained Supreme Court nominee Robert Bork’s video-rental history. The Video Privacy Protection Act prohibits a video service from knowingly disclosing personally identifiable viewing information about a consumer without proper consent.
Michael Salazar alleges that 247Sports, owned by Paramount, sent his video-viewing activity and identifying data to Facebook through Meta Pixel. He had subscribed to a free 247Sports newsletter. The legal fight is not simply over whether a tracking pixel sent data. It is over whether that newsletter subscription made him a “consumer” of the site’s video service under the old statute.
Salazar says the subscription is enough. Paramount says subscribing to a non-video product and separately watching free videos does not turn every viewer into the kind of customer Congress described. The Court’s answer could expand or narrow a privacy claim that has already been used against publishers, retailers, health sites, and other businesses with video on their pages.
There is no ruling yet, so businesses should not redesign a site around predictions from oral argument. The useful step now is more basic: know which pages contain video, which advertising or analytics scripts fire there, what identifiers those scripts receive, and what the consent record actually proves. A consent banner is not magic paperwork. If nobody can explain what the pixel sends after someone presses Play, that is the first problem to fix.
The rules around technology matter too
Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.
Ivanti VPN customers need to patch and investigate
Ivanti has patched an authentication-bypass flaw in Connect Secure, the VPN appliance many organizations place at the edge of their networks. CISA says CVE-2026-104935 is being exploited. An unauthenticated remote attacker can use it to run commands, which is a particularly bad combination for a system designed to broker access into the business.
The fixed releases are 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5 for their respective code lines. Ivanti says 22.7.x and earlier are not affected. Organizations running Connect Secure should treat this as an emergency change, but the job does not end when the version number changes. Rapid7 recommends looking for signs of compromise after patching, because an update closes the hole; it does not remove an attacker who got in beforehand. If a service provider manages the appliance, ask for both the installed version and the compromise review.
The boring machines need attention too
Browsers, workstations, remote-access tools, Wi-Fi, and ordinary office hardware rarely get much attention until one of them becomes the problem. Raymond Tec provides onsite IT and field services around Reading, Pennsylvania, along with practical help keeping the technology people use every day working and reasonably secure.
Docker fixed a token handoff that crossed identities
Docker disclosed a critical Docker Hub flaw that lived in the process for converting a personal account into an organization. During conversion, personal access tokens could be reassigned to the new owner without changing the token secret. In a malicious setup, an attacker could keep that secret while the token inherited the target user’s registry permissions. Depending on its scope, that could allow the attacker to pull, push, or delete container images under a trusted name.
Docker fixed the server-side process on September 30, notified potentially exposed users on October 2, and deactivated the identified transferred tokens on October 8 unless an owner asked to keep one. The company says it found no evidence of exploitation. It also says that if you did not receive the notice, your account was not exposed and no vulnerability-specific action is required.
That is unusually precise guidance, and it should keep this from becoming a generic “rotate every secret now” story. Teams that received the notice should follow it. Everyone else can use the disclosure as a routine-maintenance prompt: revoke stale personal tokens and use organization-owned credentials for organization automation. Credentials should belong to the work, not to whichever human happened to create the first script.
The common thread today is not the raw number of bugs. It is whether a control still tells the truth. Does Windows correctly label an outside file? Can a website account for the viewing data its pixel sends? Did a VPN patch arrive before an intruder? Does an automation token belong to the organization it can change? Those questions are less dramatic than a record count, and much more useful.
Technology has an annoying habit of connecting to everything else. Browse the News archive for current stories, or dig into Raymond Tec Insights for longer pieces about what building, fixing, maintaining, and living with this stuff actually looks like.
Sources and further reading
- Microsoft Security Response Center: CVE-2026-96951
- BleepingComputer: October 2026 Patch Tuesday analysis
- CrowdStrike: October 2026 Patch Tuesday analysis
- U.S. Supreme Court docket: Salazar v. Paramount Global
- The Washington Post: the VPPA in the streaming era
- Ivanti security advisory for CVE-2026-104935
- CISA alert for the exploited Ivanti vulnerability
- Docker Hub security advisory for CVE-2026-105445
Photo by Clint Patterson on Unsplash.
