ctxsec: Tips & Guides

Patch Tuesday triage: MotW bypass first, then exposed edge, then RCEs

Tue, 13 Oct 2026 00:00:00 +0000

For October's record Microsoft release, prioritize by exploitation evidence, not CVSS alone: (1) CVE-2026-96951 Windows Shell MotW bypass — already exploited and on CISA KEV (due Oct 16); (2) internet-facing edge already in KEV (Ivanti Connect Secure CVE-2026-104935); (3) high-likelihood RCEs Microsoft flags as "Exploitation More Likely" (Exchange, AD DS, MSMQ, Outlook). Use MSRC risk cohorts for shared-boundary bundles, then confirm with VEX. Restart browsers after Chrome updates so sandbox fixes take effect.

Track CISA KEV yourself in one command

Tue, 13 Oct 2026 00:00:00 +0000

KEV is a public JSON feed. Pull the latest additions with:

curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | jq '.vulnerabilities | sort_by(.dateAdded) | .[-5:][] | {cveID, dateAdded, dueDate}'

Automatic attack disruption needs Defender for Endpoint Plan 2, not Plan 1

Tue, 13 Oct 2026 00:00:00 +0000

A red-teamer reports MDE P2's automatic attack disruption repeatedly cut off an internal test where other products didn't (opinion, one engagement). The licensing fact is from Microsoft Learn: attack disruption needs MDE Plan 2 (or E5-class / Defender for Business). P1 gives prevention and manual response only. Set device groups to Full or Semi automation and keep the Sense agent current.