Microsoft shipped a record 1,407 CVEs on October Patch Tuesday, including an exploited Windows Shell Mark of the Web bypass. The component's 2026 record argues for a standing slot in the monthly patch cycle.
Perspective Coverage
23 publishers
- Builder
- Builder 16%
- Operator
- Operator 68%
- Investor
- Investor 16%
Reality
- Evidence74
- Adoption
- Not scored
- Hype gap+28
- Incentives
- Not scored
- Confidence72
buildOne report1 publisher Telegram Desktop let one clicked link copy a whole account over its local socket
Telegram Desktop patched a flaw, rated CVSS 8.1, that let a single clicked link ship a user's whole account to an attacker's channel. The fix reached hundreds of millions of users in September, described in the changelog as a rendering improvement.
Reality
- Evidence58
- Adoption62
- Hype gap+8
- Incentives55
- Confidence58
Three teams break into a fully patched Pixel 10 remotely at Pwn2Own Ireland
Three research teams broke into a fully patched Google Pixel 10 remotely at Pwn2Own Ireland on October 8, collecting $562,500 between them. Google has 90 days to ship fixes before the technical details go public, and Pixel owners have no patch or workaround to apply until then.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence50
Researchers at Pwn2Own Ireland 2026 collected $1,262,000 for exploiting 98 zero-day flaws across seven product categories in three days. Every exploit had to work on current firmware, so owners of those products have to wait for vendor fixes.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+10
- Incentives45
- Confidence72
Pwn2Own Ireland's second day pays $232,500 for 45 zero-days in fully patched devices
Researchers exploited 45 unique zero-days on day two of Pwn2Own Ireland 2026 for $232,500, hacking Samsung's Galaxy S26 three times. Every target ran its latest firmware, so each win is a working code-execution bug in the build owners run today.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence60
Pwn2Own Ireland teams logged 32 zero-days and over $368,000 in prizes on October 6, breaking LiteLLM, OpenAI Codex and Oracle's AI database. Vendors now have 90 days to ship fixes before the Zero Day Initiative publishes the details.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence62
Pwn2Own Ireland's first day puts LiteLLM and OpenAI Codex among 32 exploited zero-days
Pwn2Own Ireland 2026 researchers exploited 32 zero-days on day one for $388,500, including LiteLLM flaws and an OpenAI Codex argument injection. Vendors now have 90 days to ship fixes before ZDI publishes details, and the report describes contest exploits only.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives35
- Confidence55
Pwn2Own Ireland's first-day draw sends three teams at the Galaxy S26 and two at LiteLLM
ZDI's Pwn2Own Ireland 2026 schedule sets 21 exploit attempts in Cork on October 6, the largest a $300,000 remote Pixel 10 entry. The schedule names exact models and time slots, so operators of the targeted products know which results to look for on ZDI's live leaderboard.
Publishers:thezdi.com
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence65
buildOne report1 publisher Flowise deleted its CSV Agent after the regex guarding model-written code failed repeatedly
Flowise fixed a CVSS 9.8 remote-code bug in its CSV Agent with a stricter regex, then saw that filter fail through five more CVEs. It deleted the feature in June, and the patch history is a case against trusting a string filter to vet model-written code.
Reality
- Evidence64
- Adoption
- Not scored
- Hype gap−5
- Incentives25
- Confidence60
buildOne report1 publisher Windows DNS Server's 9.8 bug takes one unauthenticated packet to port 53
Microsoft patched CVE-2026-69730, a CVSS 9.8 remote code execution flaw in the Windows DNS Server role reachable with one unauthenticated packet to port 53. In most Active Directory shops that role runs on the domain controller, so the box answering on port 53 also holds the identity database.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence40
buildOne report1 publisher Two exploited Windows privilege escalations should go first in September's record Patch Tuesday
Microsoft's record September release fixed up to 997 CVEs, including two local escalations to SYSTEM that attackers used before the patch shipped. A 7.8 score understates the step that turns a phishing foothold into control of the machine, so both go ahead of the 9.8 remote flaws.
Reality
- Evidence48
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence42
A third party published CVE-2026-63520 before the planned date, and two public gadget chains now reach the same flaw by different routes. One signature will not cover both.
Reality
- Evidence72
- Adoption40
- Hype gap+5
- Incentives45
- Confidence70
The probes read Langflow's secret key file and grep the process environment for OpenAI and AWS credentials, which puts an AI orchestration tool on the same scanning clock as the Rails file-read bug of the same week.
Perspective Coverage
4 publishers
- Builder
- Builder 30%
- Operator
- Operator 60%
- Investor
- Investor 10%
Reality
- Evidence62
- Adoption40
- Hype gap+15
- Incentives65
- Confidence60
A record count that Microsoft's own AI bug-hunting produced arrives with two flaws already under attack, and the affected-product lists an operator would use to scope them are the part of the record two vendors read differently.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence58
Microsoft fixed 974 flaws in September and two were already under attack, but both need an attacker who is already on the machine, while the twenty bugs Dustin Childs classes as wormable need no login at all.
Reality
- Evidence74
- Adoption58
- Hype gap+14
- Incentives60
- Confidence71
Broadcom's VMSA-2026-0007 fixes an integer overflow in the VMXNET3 adapter and a stack overflow in HGFS, both reachable by a local administrator inside the VM, and the only remedy on offer is version 26H1u1.
Perspective Coverage
3 publishers
- Builder
- Builder 28%
- Operator
- Operator 58%
- Investor
- Investor 14%
Reality
- Evidence80
- Adoption30
- Hype gap+8
- Incentives60
- Confidence72
buildOne report1 publisher A researcher is timing zero-days to Patch Tuesday, and the monthly cadence has no reply
Ten drops since April 2026, the latest handing any local user SYSTEM on fully patched Windows 11. The next scheduled fix can be 28 days out, so mitigation has to be a day-one job.
Reality
- Evidence32
- Adoption36
- Hype gap+18
- Incentives48
- Confidence34