Major software security vulnerability updates

In early October 2026, several major software platforms issued urgent security updates to address critical vulnerabilities. WordPress released version 7.1.3 to patch seven flaws, including a second-order SQL injection and a cross-site scripting vulnerability. Microsoft issued an out-of-band update for on-premises Exchange Server to address a privilege escalation vulnerability, while LibreOffice and Apache OpenOffice addressed remote code execution flaws related to manipulated spreadsheet documents.

Later in the month, Microsoft released additional emergency security updates for various .NET versions (.NET 8, 9, 10, and 11 Release Candidate 3). These updates addressed a significant buffer overflow vulnerability in Brotli compression technology, which could lead to information disclosure or privilege escalation, as well as a vulnerability in .NET tarballs affecting Linux environments that could allow local attackers to escalate privileges.

By late October, Microsoft expanded its update rollout. The Windows 11 26H2 update became generally available for compatible devices, focusing on reliability and usability. To address specific security risks, Microsoft released an emergency cumulative update (KB5134133) for Windows 11 versions 24H2 through 26H2 to protect air-gapped or disconnected enterprise environments against certificate compromises. Additionally, administrators of Windows Server 2022 were notified that upcoming security updates for November and December 2026 will require system restarts, temporarily suspending standard hotpatching capabilities.