Microsoft released security updates on October 13, 2026, covering an actively exploited Windows Shell flaw and developer-tool vulnerabilities, according to SecurityWeek and BleepingComputer. SecurityWeek reported that the Shell flaw, CVE-2026-96951, bypasses Mark of the Web protections through a crafted file requiring user interaction. The totals differ: SecurityWeek reported 1,413 vulnerabilities, including 61 in developer tools, while BleepingComputer reported 1,411. BleepingComputer also reported a fix for a previously disclosed.NET Framework security bypass. SecurityWeek reported a fix for a previously disclosed MessagePack-CSharp denial-of-service vulnerability in Visual Studio and.NET.
NewsEditorialSource: SecurityWeek
Microsoft patched exploited Windows Shell flaw, SecurityWeek reports
Why it matters
Developers should prioritize checking and applying applicable Windows updates on development workstations and Windows build hosts because exploitation is reported. They should review product-specific advisories for Visual Studio, .NET Framework, .NET and relevant dependencies before assuming Windows updates cover every component. Microsoft’s advisory could not be retrieved during this research, leaving affected versions, fixed builds and package-update requirements unverified. Once applicable fixes are identified, teams should track installation and required restarts, then run representative builds and tests.
Attribution
Sources
- 1SecurityWeekMicrosoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-DaySource published (UTC)
- 2BleepingComputerMicrosoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-daysSource published (UTC)
Read the original source for full details and context.
EditorialSource: KrakenD
KrakenD releases Enterprise 2.13.11 security backport and Community and Enterprise 3.0.1
KrakenD released Enterprise Edition 2.13.11 as a recommended security backport on October 13, 2026, according to its changelog. [1] The changelog also lists Community and Enterprise Edition 3.0.1 releases that day. [1] It says the backport upgrades Go to 1.26.9 and updates amqp and OpenTelemetry dependencies for listed security issues. [1] According to Red Hat, CVE-2026-97032 lets an unauthenticated remote attacker crash Go’s HTTP/2 server if they win an HPACK encoder race. [2] KrakenD says affected versions are exposed when the gateway accepts HTTP/2 through Transport Layer Security negotiation or use_h2c. [3]
EditorialSource: Adobe
Adobe fixes critical vulnerabilities in Experience Manager
Adobe released fixes for critical and medium-severity vulnerabilities in Adobe Experience Manager (AEM) on October 13, 2026. [1] Adobe’s advisory lists arbitrary code execution, security-feature bypass and privilege escalation as possible impacts and assigns deployment priority 2. [1] Zero Day Initiative reported 33 distinct CVEs, explaining that Adobe’s table has 34 entries because CVE-2026-106631 appears twice. [2] According to Adobe, three incorrect-authorization flaws score 10.0 on the Common Vulnerability Scoring System and allow code execution over a network without privileges or user interaction. [1] Adobe reported no known exploitation at publication. [1]
EditorialSource: Microsoft
Microsoft releases October security updates for .NET and .NET Framework
Microsoft’s October servicing announcement lists .NET updates dated October 13, 2026, alongside new .NET Framework security and non-security updates. [1] The .NET releases—10.0.13, 9.0.21 and 8.0.32—include security and non-security fixes. Microsoft’s announcement links to release notes, installers, binaries and container images. [1] Microsoft’s .NET 10 release notes list fixes for information disclosure and denial of service. [3] BleepingComputer reported that the updates also address CVE-2026-108398, a .NET Framework security-feature bypass publicly disclosed before patching. [2]