⚡ THE ONE THING TODAY
Audit your Windows estate against CVE-2026-96951 status and prioritize any unpatched systems before end of business today.
Microsoft Teams & M365 Complaint Spike on 20 Oct — No Confirmed Outage, Admins Urged to Check Service Health
On 20 October 2026, Downdetector-style reports for Microsoft Teams hit 83 (baseline 13) and Microsoft 365 hit 73 (baseline 22), with users reporting Outlook attachment errors and login issues. Microsoft has not confirmed a single root cause or global incident. Workaround: check your tenant's M365 Admin Center Service Health dashboard for tenant-specific advisories.
Microsoft Defender Portal Bug Blocked Device Group Management (19 Oct — Now Resolved)
Incident MO1515549 confirmed that users and admins were unable to view or manage device group configurations in the Microsoft Defender portal from 14:35–15:54 UTC on 19 October 2026. Microsoft identified a code issue in the device groups page as the root cause. The incident is now marked serviceRestored; no workaround is required.
CRITICAL: CVE-2026-96951 — Windows Shell MOTW Bypass Actively Exploited, CISA KEV Deadline Passed
Microsoft's record October 2026 Patch Tuesday (13 Oct) patched 1,413 CVEs, including CVE-2026-96951 — a Windows Shell Mark of the Web security feature bypass (CVSS 8.8) confirmed exploited in the wild. Attackers use it to strip the Zone.Identifier tag from downloaded files, bypassing SmartScreen and Office Protected View. CISA added it to the KEV catalog with a 16 October federal deadline; all organisations should treat it as immediate priority — patch now via Windows Update.
WARNING: CVE-2026-108398 — .NET Framework WDAC Bypass Publicly Disclosed Before Patch
CVE-2026-108398 is a Windows Defender Application Control (WDAC) security feature bypass in .NET Framework that was publicly disclosed before Microsoft issued a patch on 13 October 2026. While not yet confirmed as exploited in the wild, public disclosure significantly raises the exploitation risk. Apply the October .NET Framework updates and review WDAC policy integrity on managed endpoints.
INFO: Rewst Launches AI-Native Automation Platform for MSPs — Plain Language Workflow Builder
Rewst announced an AI-native automation platform on 16 October 2026, enabling MSPs to build governed workflows, apps and dashboards using plain language rather than code. The release targets MSPs looking to replace complex scripted automations with governed AI orchestration across their PSA, RMM and identity stack. LogMeIn Resolve also shipped new AI and multi-tenant capabilities for service providers in the same week.
INFO: Nerdio Report — 32% of MSPs Have Adopted AI But Only 12% Can Demonstrate Measurable ROI (20 Oct)
Nerdio's 2026 State of the MSP Business Report, released 20 October 2026, found that while 32% of MSPs have adopted AI internally, only 12% report measurable productivity gains and just 14% operate a revenue-generating AI service line. The report highlights that AI adoption is significantly outpacing measurable results across the channel. MSPs are encouraged to build structured AI governance and measurement frameworks before scaling further.
This is what you get — free, in your inbox.
Subscribers also get the full “From the Floor” take with every issue — not just the summary you just read.
Written from 12 years on the helpdesk floor. Always free.