A Windows security feature can be bypassed, and attackers are using it.

What's happening.

A command injection flaw in the Windows Shell lets an attacker get past a built-in Windows security feature over a network, without logging in.

Microsoft fixed it in its October 2026 updates, released on 13 October. Microsoft and CISA both say it is being used in attacks.

What it means for you.

Security features exist to stop risky files and links from doing harm. Getting around one is often a step in a longer attack, for example to run malware that would normally be blocked. A PC that is behind on updates is easier to attack.

How to fix it.

1. Install the October 2026 Windows updates on every PC and server. Turn on automatic updates and restart when asked.
2. Check a PC is up to date: open Settings, Windows Update, and look for 'You're up to date'. Or run winver and compare the build with the table.
3. Prioritise laptops that leave the office and any server that staff or customers connect to.
4. Replace or isolate PCs that can no longer get Windows updates.