---
title: Tips & Guides | ctxsec
url: https://ctxsec.com/tips
---

# Tips & Guides

Short, practical how-tos.

guide

2026-10-13

### Patch Tuesday triage: MotW bypass first, then exposed edge, then RCEs

For October's record Microsoft release, prioritize by exploitation evidence, not CVSS alone: (1) CVE-2026-96951 Windows Shell MotW bypass — already exploited and on CISA KEV (due Oct 16); (2) internet-facing edge already in KEV (Ivanti Connect Secure CVE-2026-104935); (3) high-likelihood RCEs Microsoft flags as "Exploitation More Likely" (Exchange, AD DS, MSMQ, Outlook). Use MSRC risk cohorts for shared-boundary bundles, then confirm with VEX. Restart browsers after Chrome updates so sandbox fixes take effect.

Sources: [CISA KEV alert Oct 13](https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog) · [MSRC risk cohorts](https://www.microsoft.com/en-us/msrc/blog/2026/10/using-risk-cohorts-to-prioritize-security-updates) · [SANS ISC Patch Tuesday diary](https://isc.sans.edu/diary/0)

guide

2026-10-13

### Track CISA KEV yourself in one command

KEV is a public JSON feed. Pull the latest additions with: curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | jq '.vulnerabilities | sort_by(.dateAdded) | .[-5:][] | {cveID, dateAdded, dueDate}'

Sources: [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

tip / practitioner opinion

2026-10-13

### Automatic attack disruption needs Defender for Endpoint Plan 2, not Plan 1

A red-teamer reports MDE P2's automatic attack disruption repeatedly cut off an internal test where other products didn't (opinion, one engagement). The licensing fact is from Microsoft Learn: attack disruption needs MDE Plan 2 (or E5-class / Defender for Business). P1 gives prevention and manual response only. Set device groups to Full or Semi automation and keep the Sense agent current.

Sources: [@techspence on X](https://x.com/techspence/status/2110025535636013080) · [Microsoft Learn: configure attack disruption](https://learn.microsoft.com/en-us/defender-xdr/configure-attack-disruption)