Defense
Blue Team
Hardening, patching and protecting what you run. What to fix first this month, and how.
Patch priorities and exploited vulnerabilitiesHardening guides and secure configurationIdentity, endpoint and network defenseBackup, recovery and resilience
Finish September's Windows patches: a wormable DNS bug and two exploited flaws
September's Patch Tuesday fixed CVE-2026-69730, a Windows DNS remote-code-execution flaw described by ZDI as a successor to SigRed, plus two exploited privilege-escalation bugs: CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (ALPC).
Do this now: Confirm every Windows DNS server and domain controller has the September cumulative update. Prioritize internet-facing DNS.
October Patch Tuesday is out today (Oct 13)
Microsoft's October release lands on the 13th. Check whether any fixes are flagged as exploited or publicly disclosed before deciding your rollout order.
Do this now: Review the MSRC update guide this week and fast-track anything marked exploited.
CISA KEV additions: SharePoint, vCenter, IKE and macOS
CISA added CVE-2026-55040 (SharePoint weak authentication), CVE-2026-59310 (vCenter path traversal), CVE-2026-33824 (Windows IKE double free) and CVE-2026-65400 (macOS improper authentication) to the Known Exploited Vulnerabilities catalog.
Do this now: If you run on-prem SharePoint or vCenter, treat these as emergency patches and check access logs for the exposure window.