IT Daily Roundup: October 14, 2026
1. Microsoft patched 1,411 flaws and one Windows Shell zero-day is actively exploited
October's Patch Tuesday sets a new record: Microsoft fixed 1,411 vulnerabilities, 70 of them rated Critical. The overall count includes 677 elevation-of-privilege bugs, 317 remote code execution flaws, and 254 information-disclosure issues.
Of the three zero-days, CVE-2026-96951 in Windows Shell is actively exploited. An attacker bypasses Mark of the Web protection over the network. Microsoft has not disclosed who exploited it or how. The second zero-day, CVE-2026-108398 in .NET Framework, lets an attacker bypass Windows Defender Application Control without user interaction. James Forshaw of Google Project Zero found and reported it. Patches are available via Windows Update for all supported versions.
Why this matters: The number 1,411 sounds overwhelming, but the priority is straightforward. Patch Windows Shell first (CVE-2026-96951), since it is being exploited right now. Servers running Active Directory Federation Services are next. Microsoft fixed multiple critical spoofing flaws there.
2. FortiMail CVE-2026-104286 is actively exploited, no patch yet for branch 7.2
Fortinet confirmed active exploitation of CVE-2026-104286 (CVSS 9.8) in FortiMail. The flaw combines a path traversal with improper null byte handling, letting an unauthenticated attacker upload arbitrary files directly to the server. CISA added it to the Known Exploited Vulnerabilities catalog.
Fixed versions are 8.0.2 and 7.6.7. For branch 7.4, the patch (7.4.9) is still in development. Branch 7.2 gets no patch; those users must upgrade to 7.4 or later. Until patched: disable IBE support with config system encryption ibe / set status disable and block management interface access from the internet. Indicators of compromise include IP addresses 79.141.169[.]187 and 45.129.0[.]192 and a file at /data/bin/webconsole on the server.
Why this matters: FortiMail sits at the network perimeter as an email gateway, which makes it a high-value target. If your Fortinet deployment includes FortiMail, check the version now. Branch 7.2 means a full upgrade, not a single patch. Compare your logs against the IoC IP addresses.
3. Docker Hub fixed GhostPat: tokens from account conversions could access others' repositories
Docker fixed a two-year-old flaw, CVE-2026-105445 (CVSS 9.4 per CVSS 4.0), in the Hub feature that converts a personal account into an organization. During conversion, the original account's personal access tokens (PATs) were transferred to the new organization owner without their knowledge or notification. Those tokens could be used to pull, push, or delete Docker images in the owner's repositories and in any organizations they could access.
Docker fixed the flaw server-side on September 30; there is nothing to install. On October 8, Docker deactivated the transferred tokens it identified. If you did not receive a Docker notification dated October 2, you were not in the exposed group. Docker reviewed around 304,000 pushes made with transferred tokens and found no evidence of misuse.
← All postsWhy this matters: Teams relying on Docker Hub for CI/CD assume their tokens are theirs alone. Here they were not, for converted accounts, for two years. Check Account Settings > Personal Access Tokens and revoke anything you do not recognize or no longer need.