@GossiTheDog When we were kids, we went up to a neighbour's doorbell, rang it, and ran away.

Now we just say RpcImpersonateClient()

@GossiTheDog

#alttext

www.google.com/search
microsoft cves october 2026 DWM
In the October 2026 Patch Tuesday release, Microsoft addressed several vulnerabilities in the Windows Desktop Window Manager (DWM) and its Core Library. These flaws are part of a record-breaking update cycle fixing over 1,400 vulnerabilities. Qualys +3
The DWM vulnerabilities are categorized below by their primary security impact:
Elevation of Privilege (EoP) Vulnerabilities
Most DWM flaws patched this month are rated Important with a CVSS score of 7.8 or 7.0, allowing a local attacker with low privileges to execute code with SYSTEM-level permissions. Notably, Microsoft flags CVE-2026-69880 as "Exploitation More
Likely":
Zero Day Initiative (ZDI) +2
CVE-2026-69880 (CVSS 7.8) - Exploitation More Likely
CVE-2026 Ask about 7.8)
CVE-2026-70255 (CVSS 7.8)
CVE-2026-96108 (CVSS 7.8)
CVE-2026-88093 (CVSS 7.8)
CVE-2026-83726 (CVSS 7.8)
CVE-2026-88128 (CVSS 7.8)
CVE-2026-88177 (CVSS 7.8)
CVE-2026-85855 (High Severity)
CVE-2026-85853 (CVSS 7.0)
CVE-2026-85854 (CVSS 7.0)
Tenable +4
Information Disclosure Vulnerabilities

Microsoft will keep getting record numbers of CVEs through the next 12 months as there's decades of under investment, particularly in Windows but other areas too.

For the record any basic code scanning tool, not AI, would (and did) highlight these things. I sat on the calls where we discussed them. Nobody would fund fixing it.