Microsoft releases patch for actively exploited Windows Shell zero day vulnerability
Microsoft has patched a zero-day Windows Shell vulnerability that allowed hackers to bypass Mark of the Web security warnings.
FTMQ Security, written by our newsroom0 views
Microsoft released a security fix on October 13, 2026, for an actively exploited zero-day vulnerability in the Windows Shell, shattered.io reported. The flaw is identified as CVE-2026-96951. [1]
The vulnerability allows attackers to bypass Mark of the Web protections, according to shattered.io. Microsoft confirmed that hackers used the security flaw before a patch was made available. The Cybersecurity and Infrastructure Security Agency set a federal compliance deadline for the issue that passed on October 16. [1]
Mark of the Web is a metadata identifier that Microsoft Windows uses to label files downloaded from the internet as potentially unsafe. The operating system also applies this identifier to files from high risk sources, including external drives formatted with NTFS that contain files previously downloaded from the web. [1][4]
CyberSecurityNews separately reported that hackers are using a new bootkit called BlackX to bypass Windows Secure Boot on fully patched systems. [2][3]
In short
- Microsoft patched the Windows Shell zero-day vulnerability CVE-2026-96951 on October 13, 2026.
- The CVE-2026-96951 flaw allows attackers to bypass Mark of the Web security warnings.
- Microsoft confirmed the zero-day was actively exploited prior to the patch release.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]Windows Zero-Day CVE-2026-96951: MotW Bypass Fix [2026]shattered.io, 20h ago (the report this story comes from)
- [2]Hackers Use New BlackX Bootkit to Bypass Windows Secure Boot on Fully Patched SystemsCyberSecurityNews, 1d ago
- [3]Hackers Use New BlackX Bootkit to Bypass Windows Secure Boot on Fully Patched SystemsCyberSecurityNews, 1d ago
Background
- [4]Mark of the Web on Wikipedia
Our newsroom writes these reports with the help of software, from the 4 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- Microsoft patches actively exploited Windows Shell zero day vulnerabilityBugs and Patches, 9d ago
- Ransomware groups exploit Palo Alto Networks flaw to bypass authenticationData Breaches, 4d ago
- BlackX UEFI bootkit targets Central Asian diplomatic entities to bypass Secure BootTop Stories, 1d ago
- OpenCode silently patches critical remote code execution vulnerability in developer toolData Breaches, 4d ago
More in Bugs and Patches
- Researchers publish proof of concept exploit for Node js Brotli vulnerability1h ago
- Microsoft releases record October 2026 update containing 1413 vulnerabilities1h ago
- PHP Foundation issues urgent patches for decade old remote code execution flaws1h ago
- Indian CA eMudhra suffers private key compromise in intermediate certificates1d ago
- PHP advises disabling session upload progress following new unpatched flaw1d ago
- PHP security team issues mitigation for unpatched remote code execution vulnerability1d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.