Microsoft's October release fixed around 1,400 flaws, including a Windows Shell bug under active attack that lets a crafted file bypass Mark-of-the-Web protections. CISA gave federal agencies three days to patch. Ask this week: have we confirmed this update reached every endpoint, not just the ones due this cycle.
Microsoft's October update covered around 1,400 vulnerabilities, its largest release to date. CVE-2026-96951, a Windows Shell flaw (CVSS 8.8), lets a crafted file bypass Mark-of-the-Web tagging and is confirmed exploited. CISA added it to KEV the same day, with a 16 October federal deadline.
So what: confirm the update has reached every endpoint, including devices outside standard ring deployment.
Microsoft's final-reminder notice confirms the MemberOf rule operator in dynamic groups, admin units and entitlement-management auto-assignment stops working on 3 November. The notice newly flags Conditional Access policies built on affected groups as also exposed. Memberships freeze at their last calculated state; there is no direct replacement for nested logic.
So what: run Microsoft's suggested Graph PowerShell query now to find every MemberOf rule, including any feeding Conditional Access.
Microsoft notified customers via Azure Service Health of VM and storage price rises of 8–17 per cent across seven regions, plus a roughly 25 per cent rise on legacy Dv3/Dsv3/Ev3/Esv3-era series, effective 1 February 2027. Reservations bought on or after that date also lose the right to exchange.
So what: review commitment timing and legacy VM series now — acting before 1 February preserves the lower rate and exchange flexibility.
The Digital Omnibus gives AI systems already on the market before 2 August 2026 until 2 December 2026 to add machine-readable content marking under Article 50(2). Deepfake and chatbot disclosure duties under Article 50(1) and (3) still applied from 2 August, unextended — a distinction some commentary has blurred.
So what: check which duty applies to which system — assuming December covers deepfake labelling too would leave you already non-compliant.
| Change | Platform | What it breaks or requires | Act by |
|---|---|---|---|
| CVE-2026-96951 Shell MOTW bypass | Microsoft Windows | Actively exploited; crafted file bypasses Mark-of-the-Web. | Overdue |
| MemberOf rule retirement | Microsoft Entra ID | Dynamic groups, admin units and Conditional Access freeze at last state. | 3 Nov 2026 |
| Reservation exchange ends | Microsoft Azure | New or renewed reservations lose exchange rights after cutover. | 1 Feb 2027 |
| Compute/storage price rises | Microsoft Azure | 8–25% increases depending on region and VM series. | 1 Feb 2027 |
| Watermarking grace period ends | EU AI Act, Art. 50(2) | Pre-Aug-2026 systems must add machine-readable marking. | 2 Dec 2026 |
Identifiers and dates as published by Microsoft and CISA. Confirm applicability against your own estate.
Standing watch — sovereign cloud and data residency. No new sovereign-cloud announcements this fortnight. Microsoft's EU Data Boundary programme remains complete; track supplier data-boundary commitments at contract renewal.
We assess it is likely further Entra ID and Windows advisories follow as the MemberOf deadline passes, and a realistic possibility AWS or Google announce a comparable platform or price change after a quiet fortnight. Expect no further AI Act movement before the December marking deadline forces disclosure.
Monday 9 November 2026. Send additions, corrections or platform intelligence to your ClearPath engagement lead.
