People who use Windows PCs should check for the latest updates, restart when asked, and check again. Malwarebytes reports that attackers are already using one fixed Windows flaw.
In 60 seconds
- Windows PC users should check for updates now because Malwarebytes reports active attacks against one fixed flaw.
- Open Settings, choose Windows Update, install available updates, restart, and check again.
- Until the update finishes, do not open unexpected links or attachments.
- The supplied report does not list affected Windows versions, so check each computer directly.
Who should care and what to do today
This alert concerns people using Windows computers and anyone responsible for checking Windows PCs. The supplied report does not list specific Windows versions, so the safest way to check is on each computer.
Open Start, select Settings, and choose Windows Update. Select Check for updates. If Windows offers updates, install them and restart when asked. Then return to Windows Update and check again. The page should say “You’re up to date.”
Until the update is finished, do not open unexpected email or instant-message links or attachments. Malwarebytes says the Windows flaw being exploited requires a person to click a link or open a specially crafted file.
What Malwarebytes reports
Malwarebytes reports that Microsoft’s October updates address 1,413 security problems. The release includes a Windows Shell flaw that attackers are already exploiting, along with two other flaws that were publicly disclosed.
Malwarebytes identifies the actively exploited Windows flaw as a zero-day, meaning attackers are using it before users have had broad opportunity to apply the fix. The flaw can bypass Mark of the Web, a Windows warning that may appear for some downloaded files.
The report does not say that every Windows computer has been attacked. It says exploitation is active and that user interaction is required. Installing the available update and treating unexpected files carefully are the immediate steps supported by the report.
Two other publicly disclosed flaws
Malwarebytes also describes a local security-feature bypass in .NET Framework. The report says an authorized attacker could use an untrusted search path to bypass Windows Defender Application Control, which could allow unauthorized applications to run on a target computer.
The report identifies another flaw that can let an unauthenticated remote attacker exhaust memory in applications that process specially crafted MessagePack data. MessagePack-CSharp is a software component that helps applications pack and unpack data in a compact format. The report says exposure depends on how a service uses the component.
Most readers do not need to identify these components. The useful check is whether each Windows computer has completed the latest available update and restart.
If the update is not finished
Windows may need a restart before the update is complete. After restarting, open Windows Update again and check its status. If it still offers updates, install them and restart again rather than assuming the first download finished.
Keep unexpected links and attachments closed while the computer is waiting for updates. According to Malwarebytes, the reported Windows attack depends on someone opening or clicking specially prepared content.
Does this affect me?
- Who may be affected
- People using Windows computers, and people responsible for managing Windows PCs, should check this alert. The supplied report describes a Windows flaw but does not list affected Windows versions.
- How to check
- On each Windows computer, open Start > Settings > Windows Update and select Check for updates. After installing and restarting, check again for “You’re up to date.”
- What to do
- Install the available Windows security updates and restart when prompted. Repeat the Windows Update check after restarting.
- What to avoid
- Do not open unexpected email or instant-message links or attachments while waiting for the update. Malwarebytes says the reported attack requires that user action.
Common questions
How can I check whether the latest available Windows updates are installed?
Open Settings, select Windows Update, and check for updates. Install anything offered, restart the computer, and check again. Malwarebytes’ instructions say the update process is complete when Windows Update says “You’re up to date.”
Can attackers compromise the computer just by sending a file?
The Malwarebytes report says the Windows flaw requires user interaction. In its example, the person must click a link or open a specially crafted attachment or file.
What does “zero-day” mean in this report?
Here, Malwarebytes identifies the actively exploited Windows flaw as a zero-day, meaning attackers are using it before users have had broad opportunity to apply the fix.
Does the report list which Windows versions are affected?
No. The supplied evidence describes the Windows flaw and the update steps, but it does not provide a version list. Check Windows Update on each computer rather than guessing from its model or age.
Primary source
This article is based on Malwarebytes’ report, “Update Windows: Record Patch Tuesday fixes flaw already under attack,” published October 14, 2026: https://www.malwarebytes.com/blog/bugs/2026/10/update-windows-record-patch-tuesday-fixes-flaw-already-under-attack. The supplied evidence does not include a Microsoft supporting source. Read the complete original source.
Get the important updates without the noise
Choose the devices and topics you care about in Cyber Alerts.
Article history: Published Oct 14, 2026 at 8:15 am EDT. Updates and corrections are noted here when material facts change.
