Windows shell

One flaw was already being exploited before the fix arrived.

It sits in the Windows shell.

and it lets an attacker get round a window safety check, the warning you're meant to see when you open something that came from the internet.

The attack arrives as a crafted email or message carrying a malicious link or attachment.

In the number one spot, it's Windows with 1,102, Office in second place at 134, and SharePoint Server at 36.

One Windows Shell security feature bypass is under active attack.

Trend AI's Zero Day Initiative researcher, Dustin Childs, says AI is speeding discovery, but exploitation isn't keeping pace.

Microsoft's new risk cohorts group flaws needing similar customer assessments to help admins prioritize.

So there's less zero days that are out there from 2023 to 2026.

So three years later we've got less.

Microsoft did disclose one actively exploited zero day is Windows Shell.

So in fact, let's, let's grab this one real quick.

Top story number three, Microsoft has issued a massive Patch Tuesday update covering one thousand four hundred and thirteen vulnerabilities across Windows, Office, developer tools, and SharePoint, setting a new company record for disclosed flaws.

The release includes one actively exploited zero day in Windows Shell, CVE-202696951, which can let attackers bypass a security feature and marks the third such flaw in Windows Shell this year.

The scale of disclosure underscores growing pressure on security teams to prioritize patching based on exploitability, not just volume.

In other news, security researchers at Expo used OpenAI's GPT 5.6 Sol model to help chain three Chrome zero day vulnerabilities into an exploit that could escape browser sandboxes and run code on Windows machines, potentially exposing about one billion users.

A three vulnerability zero day chain gave attackers root access to a fully patched Ivanti Connect Secure VPN.

Patch Tuesday and Microsoft just set a new record, 1,411 vulnerabilities, including one actively exploited Windows Shell bypass.

SAP's Cloud SDK for Python has a perfect 10 CVSS flaw, sending your OAuth 2.0 client secrets to attacker-controlled servers, and the OpenAI insider case just got a whole lot weirder.

We have 13 stories this morning.

Of the fourteen hundred and eleven vulnerabilities, seventy of them are rated critical, and the breakdown includes six hundred and seventy-seven elevation of privilege flaws, three hundred and seventeen remote code execution vulnerabilities, two hundred and fifty-four information disclosure issues, seventy-three denial of service vulnerabilities, forty security feature bypasses, and twenty-eight spoofing vulnerabilities.

One is being actively exploited in the wild, and two are publicly disclosed.

The actively exploited zero day is CVE-2026-96951, a Windows Shell security feature bypass that allows an unauthorized attacker to bypass mark of the web protection over a network through command injection.

The, uh, MOTW is the mechanism Windows uses to flag files downloaded from the internet and prompt users' confirmation before execution.

Roughly eleven hundred are in Windows alone, with a hundred thirty-four in Office, sixty-one in developer tools, thirty-six in SharePoint Server, and twenty-two in SQL Server.

Included is an exploited Windows Shell bug.

That's your anchor.

With a batch this size, testing capacity gets strained, and you can't treat every fix as equal.