This is our weekly briefing for software and IT service companies, covering the week to 15 October 2026. It follows our earlier post on AI coding tools for IT companies. This week the news is about patching, new EU reporting duties and a nasty supply chain attack on developer machines.
Last updated: 15 October 2026. Counts differ between outlets, and some details come from security vendors and law firms rather than official advisories, so please check the linked sources before acting on any detail.
The short version
- Microsoft shipped a record Patch Tuesday. More than 1,400 flaws were fixed on 13 October, including one already-exploited Windows zero-day. Some Windows versions also got their final update.
- EU Cyber Resilience Act reporting is live. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents on a 24-hour, 72-hour and final-report clock.
- A worm on npm can wipe your machine. The malicious tensorlake 0.5.144 package targets developer machines, and revoking a stolen token in the wrong order can trigger deletion of the home folder.
1. Microsoft's record Patch Tuesday
Microsoft released its October 2026 security updates on 13 October. The headline is the size.
- BleepingComputer counts 1,411 flaws, a record. That count covers only flaws released on Patch Tuesday itself; it says another 348 were fixed earlier in the month. It lists 70 rated Critical: 57 remote code execution, 11 elevation of privilege and 2 spoofing.
- SecurityWeek counts 1,413 CVEs: 1,102 in Windows, 134 in Office, 61 in developer tools and 36 in SharePoint Server. It says that is more than all of 2025 and that the 2026 total has passed 4,000. It attributes the surge largely to AI-assisted bug finding, but gives no breakdown, so treat that as a reported view rather than a measured fact.
The two outlets count slightly differently, which is why the numbers are 1,411 and 1,413. Either way, it is a record.
The zero-days
- CVE-2026-96951 is a Windows Shell flaw that bypasses Mark of the Web (the warning Windows shows on files from the internet), with a CVSS score of 8.8. It is already exploited. The attacker has to convince a user to open a crafted file. According to SecurityWeek, CISA added it to its Known Exploited Vulnerabilities catalog and set 16 October as the deadline for US federal agencies.
- CVE-2026-108398 was publicly disclosed before a fix. It is a .NET Framework bypass of Windows Defender Application Control, found by James Forshaw of Google Project Zero, according to BleepingComputer.
- CVE-2026-92707 was also publicly disclosed before a fix. It is a denial of service in MessagePack-CSharp, used in Visual Studio and .NET.
Other changes worth knowing
- Microsoft introduced risk cohorts, 15 groups of related flaws. Microsoft calls this experimental and says the groups do not necessarily show which flaws are most dangerous, so do not use them as a patch order.
- End of support. Per BleepingComputer, October was the last update for Windows 11 24H2 Home and Pro and for Windows 10 Enterprise LTSB 2016. Windows 11 23H2 Enterprise, Education and IoT Enterprise stop receiving security updates next month.
- Other vendors. BleepingComputer's roundup says some flaws in Citrix NetScaler, Fortinet FortiMail, Ivanti Connect Secure and SonicWall SMA1000 were already exploited in attacks. Those are internet-facing products, so they deserve attention first.
What it means for your IT company
- Patch in order of exposure. Internet-facing gateways and VPNs first, then the exploited Windows Shell flaw on all workstations, then everything else.
- Do not wait for a perfect cycle. With this volume, a monthly patch window may need extra emergency slots. Test on a small group, then roll out quickly.
- Check your clients' Windows versions. Anyone on Windows 11 24H2 Home or Pro, or 23H2 Enterprise next month, needs an upgrade plan.
- Remind staff about files from outside. The zero-day needs a user to open a crafted file, so a short note on downloads and email attachments helps.
- Tell clients. If you run managed IT, a short note on what you patched and what still needs their action is worth sending.
2. EU Cyber Resilience Act: reporting duties now apply
According to the European Commission's CRA reporting page, from 11 September 2026 manufacturers must report actively exploited vulnerabilities and severe incidents affecting products with digital elements.
| Step | When |
|---|---|
| Early warning | Within 24 hours of becoming aware |
| Full notification | Within 72 hours |
| Final report (exploited vulnerability) | Within 14 days after a fix is available |
| Final report (severe incident) | Within one month of the 72-hour notification |
You report once, through the CRA Single Reporting Platform run by ENISA. The report is addressed to the CSIRT of the country where your company is mainly established, and ENISA is informed at the same time.
Other dates: open-source software stewards have obligations from 11 December 2027 (Article 24(3)), and the main CRA obligations apply from 11 December 2027.
Law-firm commentary, which is secondary and not an official source, adds three points:
- The duty can apply to products you sold earlier, if you become aware of exploitation on or after 11 September.
- Fines of up to 15 million euros or 2.5% of worldwide turnover are cited.
- Guides advise creating the EU login for the reporting platform in advance, so you are not doing it during an incident.
Whether bespoke software built for a single client counts as a "product" under the Act is a legal question. Ask a qualified adviser about your own case. This is not legal advice.
What it means for your IT company
- Work out if you are a manufacturer. List the products you sell or distribute with software in them, and ask an adviser which ones are in scope.
- Create the platform login now. Do it before an incident, not during one.
- Write a one-page incident clock. Who decides that an exploit is "active", who files the 24-hour warning, who owns the 72-hour notification.
- Know your own components. Keep a list of the libraries in each product so you can tell quickly whether a new exploited flaw affects you.
- Update client contracts. Agree who reports what when you build or maintain products for others.
3. The Tensorlake npm worm and the "hostage token"
Security firm StepSecurity published an analysis of a compromised tensorlake npm package. Here is what it reports.
- What happened. A malicious tensorlake 0.5.144 was published to npm on 8 October 2026 at 01:12 UTC, after malicious commits were pushed to the project's main branch on 7 October under a maintainer's name. The last clean version is 0.5.143.
- It looked legitimate. The package carries a valid provenance attestation, because it was built from the project's own workflow. Provenance tells you where a package was built, not that the code was safe.
- It targets developers, not servers. A preinstall script skips itself on CI, so developer machines are the target.
- What it steals. It downloads a runtime and runs an obfuscated file that collects GitHub and npm tokens, cloud keys, Kubernetes and Vault secrets, SSH keys, saved browser logins and AI tool configurations. The data is sent to a public GitHub repository created in the victim's account, or to an outside domain.
- How it spreads. It republishes the victim's own npm packages using stolen npm tokens. It also commits .claude and .vscode files into the victim's repositories, so it triggers again when someone opens the project in Claude Code or VS Code.
- The hostage token. If it finds a GitHub token, it installs a monitor that checks the token every 60 seconds for up to 24 hours. If GitHub rejects the token, it deletes the home folder. So revoking the token while the monitor is still running can wipe the machine.
StepSecurity reports no PyPI packages involved.
The safe order of clean-up
StepSecurity's remediation order, in short (read their post for the per-operating-system steps):
- Check lockfiles and run npm ls for version 0.5.144.
- Pin 0.5.143, delete node_modules, clean the npm cache, and consider setting ignore-scripts=true.
- Before revoking any tokens, remove the monitor service and its files. Follow StepSecurity's steps for your operating system.
- Then rotate every credential the machine could reach.
- Check for spread: public repositories with a Shai-Hulud description, commits from a claude noreply address, and unexpected .claude or .vscode files.
- If you are unsure, reinstall the machine.
What it means for your IT company
- Search now. Check all projects and developer laptops for tensorlake 0.5.144, not just CI.
- Do not panic-revoke. If a machine is affected, follow the order above. Revoking first is the one step that can destroy data.
- Treat project config files as code. Review .claude and .vscode files in pull requests, since the worm uses them to run again.
- Consider ignore-scripts. Turning install scripts off by default blocks this kind of attack, at the cost of a few packages needing manual setup.
- Do not trust provenance alone. It is a useful signal, but this package had it and was still malicious.
A checklist for this week
- Patch internet-facing gateways and VPNs, then roll out the October Windows updates, starting with the exploited Windows Shell flaw.
- List client machines on Windows 11 24H2 Home and Pro and on 23H2 Enterprise, and plan their upgrades.
- Search every repository and developer laptop for tensorlake 0.5.144, and follow the safe clean-up order if you find it.
- Review .claude and .vscode files in your repositories and add them to code review.
- Create your CRA reporting platform login and write a one-page 24-hour, 72-hour and final-report plan.
- Ask a legal adviser whether your products, including any bespoke software, fall under the Cyber Resilience Act.
How SimpleApp can help
We build and maintain software with security reviews, dependency checks and clear release notes. See our custom software development and maintenance and support services, or get in touch and tell us what you need.