{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "windows-shell-zero-day-oct-2026",
  "url": "https://patchgap.ai/incidents/windows-shell-zero-day-oct-2026/",
  "path": "/incidents/windows-shell-zero-day-oct-2026/",
  "json_url": "https://patchgap.ai/incidents/windows-shell-zero-day-oct-2026.json",
  "title": "Windows: a bug that lets a bad file skip Windows' safety warnings is being used by hackers",
  "category": "windows",
  "platforms": [
   "windows"
  ],
  "products": [
   "windows"
  ],
  "status": "patched",
  "status_label": "Patched: update now",
  "severity": "high",
  "severity_source": "NVD score 8.8 out of 10 (CVE-2026-96951)",
  "exploited_in_wild": "yes",
  "exploited_note": "Microsoft marks it as 'Exploitation Detected' and the US government's CISA lists it as used in real attacks (added Oct 13, 2026).",
  "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
  "confidence": "confirmed",
  "confidence_note": null,
  "first_reported": "2026-10-13",
  "updated_at": "2026-10-27",
  "cves": [
   "CVE-2026-96951"
  ],
  "summary": "Windows normally shows a warning when you open a file you got from the internet or an email. A bug in Windows lets some bad files skip that warning. Hackers are already using this bug. Microsoft fixed it in its October 2026 update (Oct 13). You still have to install that update.",
  "am_i_affected": "You are at risk if your Windows computer has not installed the October 13, 2026 update or any update after it. Open Settings > Windows Update. If it says 'You're up to date' and Update history shows an update from October 2026 or later, you are covered.",
  "action": "Run Windows Update (October 2026 update or newer)",
  "affected": [
   {
    "product": "windows",
    "product_name": "Windows 10 and 11",
    "platform": "windows",
    "affected_versions": "Windows computers that have not installed Microsoft's October 13, 2026 security update",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "Fixed by the October 13, 2026 Windows security update (or any newer update). Microsoft's Update Guide lists the exact update for each Windows version.",
    "fixed_source_urls": [
     "https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct"
    ],
    "check": {
     "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
     "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
   }
  ],
  "fix_steps": [
   "Open Start > Settings > Windows Update.",
   "Click Check for updates.",
   "Let the updates download and install.",
   "Restart your computer when it asks.",
   "Until you have updated, do not open files from emails or chats you did not expect, even if they look normal."
  ],
  "official_patch_links": [
   {
    "label": "Microsoft: how to update Windows",
    "url": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
   },
   {
    "label": "Microsoft October 2026 update notes",
    "url": "https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct",
    "title": "Microsoft: October 2026 Security Updates release notes",
    "date": "2026-10-13",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
    "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-96951",
    "date": "2026-10-13",
    "kind": "cisa",
    "official": true
   },
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96951",
    "title": "NVD: CVE-2026-96951",
    "date": "2026-10-13",
    "kind": "nvd",
    "official": true
   }
  ]
 }
}