Windows users should install Microsoft's October 2026 security update without delay. One flaw in that release, tracked as CVE-2026-96951, affects Windows Shell, the part of Windows that handles files you open, and Microsoft has confirmed that attackers are already using it in the wild.

What the flaw does

When you download a file from the internet, Windows normally tags it with a safety marker known as Mark of the Web. That marker is why you sometimes see a warning before a downloaded file opens, and why documents from the internet may first open in a safer, read-only view. This flaw strips that protection away, so a harmful file sent by an attacker could open as if it were a file you created yourself, with no warning and no second look.

How attacks reach victims

The attacker cannot force this flaw on a computer on their own. They must trick the victim into opening a rigged file or clicking a link, usually sent by email or instant message. That makes phishing awareness just as important as patching: do not open unexpected attachments, even if they appear to come from a familiar sender, and check before clicking links in unsolicited messages.

What to do now

Open Settings, go to Windows Update, check for updates, install everything offered, and restart if asked. The fix is not complete until the restart finishes, so keep the computer plugged in and connected while it updates. The US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities list on the day the fix was released and ordered federal agencies to apply it by 16 October, a sign of how seriously defenders are treating it.