Patch [FIX] Tuesday: October 2026 – [An Exploited MOTW Bypass and a Reading Pane RCE], E37
Download MP3Another heavy Patch Tuesday, and Serena DiPenti and Seth Hoyt start with the bug Microsoft confirms attackers are already using: a Windows Shell flaw that gets files past Mark of the Web. A user still has to open the file, but it opens with no SmartScreen warning, no Protected View, and no macro block, and Microsoft rates it only Important.
They also cover:
They also cover:
- Why one of the credited finders on that Shell bug used Anthropic's Claude, and what AI-assisted research is doing to the report volume at every vulnerability disclosure program
- An Outlook remote code execution bug that fires when a crafted email shows in the Reading Pane, with no open and no click, and why Office updates need checking separately from Windows updates
Don't let the severity label set your order. Patch the exploited bug first, and confirm Office actually updated.
![Patch [FIX] Tuesday: October 2026 – [An Exploited MOTW Bypass and a Reading Pane RCE], E37](https://img.transistorcdn.com/EkE0AzI6mCuwCWQ20ROHA6b7ZfFM8UArCnMefykNc4Y/rs:fill:0:0:1/w:800/h:800/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS9mMGFk/OWJmN2MyNzE4NmIz/YzcyYmVmMWQ1YWJl/MDZhMy5wbmc.webp)