Cyber Security Action Month 2026: Take a second. Stay secure.
Microsoft released its largest Patch Tuesday on record this week. Microsoft typically publishes at 10:00 am Pacific Time (The Blog Timer), so for teams across Australia and New Zealand the updates landed in the early hours of Wednesday 14 October.
The headline number depends on who is counting. BleepingComputer reports 1,411 flaws, NT Compatible reports roughly 1,413 CVEs across 176 updates, and Action1 reports 1,409 patches. Whichever figure you use, September's record of about 995 has already been left behind.
Here is our position at Insicon Cyber. Stop counting patches. Count exposure. A board that asks "have we applied 1,400 fixes?" is asking the wrong question. The right question is "which of these could hurt us this week, and how fast did we close them?"
This is the practical version of that answer, built for Cyber Security Action Month, where ASD's theme is Take a second. Stay secure. and the first action on its list is to apply updates when they become available.
Of roughly 1,400 fixes, three zero-days and a handful of critical flaws deserve your attention first. Per BleepingComputer:
The release also includes 70 Critical vulnerabilities, 57 of them remote code execution. Among the Critical items are an Active Directory Domain Services remote code execution flaw (CVE-2026-70229), two Active Directory Federation Services spoofing flaws (CVE-2026-96222 and CVE-2026-108131), and an Azure App Service remote code execution flaw (CVE-2026-77900). Identity infrastructure is where a single missed patch can become a whole-of-network problem.
Two more things for your calendar. Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 received their last security update this month, and Windows 11 23H2 Enterprise and Education editions stop receiving updates next month (BleepingComputer). Office LTSC 2021 also leaves support on 13 October 2026 (Computerworld). An unsupported system does not get tomorrow's patch.
Microsoft is using AI to find and fix vulnerabilities in its own products, which is part of why the numbers have climbed so fast. ASD is asking organisations to prepare for AI-enabled cyber threats, and the same logic applies to attackers hunting for the flaws you have not yet fixed.
Microsoft's own response is a new experiment called risk cohorts. It groups October's fixes into 15 themes, such as 136 CVEs affecting Windows filesystems, storage and backup, 135 affecting Office documents and mail clients, and 131 affecting Windows graphics, media and content processing. Microsoft is clear that cohorts do not rank danger and do not replace its usual guidance. Real risk still depends on exploitation, severity and how you use the software (BleepingComputer, Cyber Security News).
Used well, cohorts are a filtering tool. They help you ask one question per area instead of 1,400 questions.
Use the cohorts as a checklist of questions. Is SharePoint installed and reachable? Which Office versions are out there? Are there domain controllers, AD FS servers or Exchange servers? Which .NET Framework versions sit behind your line of business applications? If you cannot answer these from an asset register in minutes, that is your first finding for the board.
This is where the work we shared with TrendAI in our recent webinar, Stop exploits before CVEs even exist, applies directly.
In that session, Greg Bunt, Co-Founder, Director and Fractional CISO at Insicon Cyber, and Dominic Biddlecombe from TrendAI explained why severity scores alone cannot prioritise anything useful. Dominic walked through the TrendAI Vision One funnel live: close to 400,000 known vulnerabilities, narrowed to roughly 46,000 with a working exploit, and then to around 2,000 being actively exploited right now. The lesson for a release like this one is simple. Most of the 1,400 are real, but only a small slice is both present in your environment and reachable by an attacker today.
In our Adaptive SOC (aSOC) in North Sydney, we run TrendAI Vision One alongside our other platforms and our own threat intelligence, and we use it to sort a release like this into three buckets for each client:
You do not need our platform to start. A spreadsheet of assets, a list of exploited CVEs from Microsoft and the CISA Known Exploited Vulnerabilities catalogue, and an honest view of what faces the internet will get you most of the way.
See your own funnel
Start a 30-day TrendAI Vision One trial and point it at your own estate, or ask for a complimentary Cyber Readiness Assessment of your patching and vulnerability management posture across Australia and New Zealand.
Start the 30-day trial Request an assessmentA tiered rollout beats installing everything at once. The deadlines below draw on the Essential Eight in Australia and the NZISM in New Zealand.
| Window | What to do | Why |
|---|---|---|
| By Friday 16 October (48 hours) | Patch the Windows Shell zero-day on all endpoints. Patch internet-facing servers and identity infrastructure (AD DS, AD FS) that carry Critical or exploited flaws. | The Essential Eight Maturity Level One expects internet-facing patches within 48 hours when vulnerabilities are critical or working exploits exist. The NZISM says New Zealand government agencies MUST apply critical patches within two days. It is a sound benchmark for any New Zealand organisation. |
| Days 3 to 7 | Pilot ring (a small, varied group of users and devices), then broad workstation rollout. Windows 11 users on 26H2, 25H2 and 24H2 receive KB5127648 (Neowin). | Catches application conflicts before they hit everyone. |
| Days 5 to 14 | Remaining servers in agreed maintenance windows. Confirm .NET Framework versions and application control settings. Include Office and SharePoint. | Non-critical, non-exploited fixes can follow the normal change cycle, within about two weeks. |
| Before 10 November | Close exceptions, retire or isolate unsupported systems, and report. | Next Patch Tuesday is 10 November. |
Two practical tips. First, install the latest servicing stack update before the monthly update, and remember Windows updates are cumulative (NT Compatible). Second, where downtime costs real money, note that hotpatching is now generally available for Windows Server 2025 Azure Edition virtual machines, which can apply fixes without a full reboot (same source).
Some systems cannot be patched in 48 hours. A finance system with a quarterly change freeze is a real constraint, not a failure of discipline. This is the gap Greg and Dominic spent much of the webinar on: virtual patching and compensating controls shield a vulnerable system while your change process runs at its normal pace.
Where a virtual patch rule exists for a given CVE, it can block exploit attempts at the network layer before the vendor fix is installed. Coverage is specific to each CVE, so check it rather than assuming it. For managed clients, the aSOC applies compensating controls according to the RASCI matrix agreed at onboarding, which sets out what we can do immediately and what needs client sign-off. Other practical controls include:
A patching report that lists CVE numbers is not a board report. We recommend five lines:
In Australia, this evidence supports Essential Eight maturity assessments and sits comfortably alongside CPS 230 operational risk expectations for APRA-regulated entities. In New Zealand, it demonstrates the patching discipline the NCSC New Zealand expects through its patching minimum standards.
If you do only three things before Friday:
That is the "take a second" version of Patch Tuesday. It will not fix 1,400 flaws by Friday, and it does not need to.
Insicon Cyber is an award-winning Australia and New Zealand cybersecurity partner delivering Board Cyber Advisory, CISO-as-a-Service, Managed Compliance, AI Security and Governance, and our Adaptive SOC (aSOC). Headquartered in North Sydney with Australian data sovereignty and ISO 27001 certified. Visit insiconcyber.com.