Defender's Corner

Microsoft's October Windows 11 update quietly broke Smart App Control for some users, according to Bleeping Computer. The feature — which blocks potentially harmful apps and unknown binaries from running — appeared greyed out and couldn't be switched on, leaving some machines less protected than their owners realised.

Microsoft has fixed the issue in the KB5127936 update, released October 28, 2026. Here's what to do right now:

1. Open Windows Security → App & browser control → Smart App Control settings
2. Check it shows as On — not greyed out, not "Evaluation"
3. If it's greyed out, go to Settings → Windows Update and install any available updates

Smart App Control works alongside Microsoft Defender to stop unrecognised software before it runs. If it was silently disabled on your machine, you've been without that layer of protection for weeks.

A joint guide published on October 16, 2026 by NIST, CISA, and the NSA on AI agent incident response makes one thing clear: the first question in any security incident is always "whose credentials were used?" That principle applies to everyone, not just enterprise security teams.

Credential sprawl — having API keys, login tokens, and account access scattered across apps and services you've forgotten about — means attackers can act under your identity long before you notice anything is wrong. Reviewed by BeyondTrust via Bleeping Computer.

What you should do: Spend ten minutes today reviewing which apps and services have access to your accounts. On Google, visit myaccount.google.com/permissions. On Microsoft, check myapps.microsoft.com. Revoke anything you don't recognise or no longer use.

Google has upgraded Chrome's Enhanced Protection mode with server-side AI scam detection, as covered by Bleeping Computer.

The updated feature analyses page content, brand signals, and site intent to catch scam pages before you engage with them. It now also detects ClickFix attacks — a technique where malicious pages trick users into copying and running dangerous commands themselves by disguising them as routine troubleshooting steps.

If Chrome spots a suspicious command in your clipboard from this type of attack, it strips identifying information from it and checks it against Google's Safe Browsing service. If it flags as dangerous, you see a warning before anything runs.

Google states page content is processed temporarily and never stored or used for model training.

What to do: In Chrome, go to Settings → Privacy and Security → Security → and select Enhanced Protection. It takes about 10 seconds.

ClickFix is a social engineering technique (a trick that manipulates people rather than exploiting software) where a fake error page — dressed up as a Cloudflare check or Google reCAPTCHA — instructs you to copy a command and paste it into your computer's Run dialog or Terminal. The moment you press Enter, the malware runs. Because the command leaves the browser entirely, Chrome's usual download protections never see it.

Google is now rolling out a defence in Chrome: if you copy a suspicious command while Enhanced Protection is enabled, Chrome intercepts the clipboard content, scrubs personal data, and checks it against Safe Browsing before you get the chance to paste and run it. A warning appears if the command is flagged as dangerous.

What to do: In Chrome, go to Settings → Privacy and Security → Security → select Enhanced Protection. It is free, already available, and now does something traditional download scanning could not.

MITRE — a nonprofit research organisation that maintains one of the most widely used frameworks for understanding how attackers behave — released version 20 of its ATT&CK framework last week, according to Security Week.

The update is worth knowing about even if you are not a security professional. It now formally tracks how attackers abuse AI tools, steal application-specific passwords to bypass MFA (multi-factor authentication, the extra verification step beyond your password), and manipulate AI-assisted search results.

What this means for you: ATT&CK v20 adds entries for a specific type of password theft that lets attackers log in to services without triggering an MFA prompt. If any of your accounts offer "app passwords" for older integrations — common in email clients — review and revoke any you no longer use. That removes one avenue the new entries describe.

The free framework is available at attack.mitre.org.

TLS (Transport Layer Security) is the protocol that encrypts data moving between a browser and a website — the padlock in your address bar. The UK's National Cyber Security Centre has updated its guidance, and the message is direct: if you are still running TLS 1.2 or older, start planning your move to TLS 1.3 now, according to the NCSC.

TLS 1.3 is the only version that supports post-quantum cryptography (PQC) — encryption methods designed to resist attacks from future quantum computers. Earlier versions will not be upgraded to support it.

If you manage a server or website: Check which TLS version you are running, disable TLS 1.1 and 1.0 entirely, and prioritise migration to TLS 1.3. The NCSC recommends completing high-priority migrations by 2031, but the tools to do it exist today.

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-96951 — the Windows Shell zero-day covered above — to its Known Exploited Vulnerabilities (KEV) catalog and instructed all federal civilian agencies to patch by Friday, 16 October. The advisory is available from The Record.

For everyone else: that Friday deadline is a useful benchmark. Microsoft's October Patch Tuesday fixed over 1,400 vulnerabilities, including this actively exploited flaw. Waiting for your device to update on its own schedule is reasonable for routine patches — less so when a zero-day is already in use.

How to check: On Windows, open Settings → Windows Update → Check for updates. If the October 2026 updates are available, install them. A restart will be required.

Let's Encrypt — the free certificate authority that provides the padlock in your browser — is shortening the lifetime of the security certificates it issues, according to SecurityWeek. From February 2027, new certificates will last 64 days instead of 90. A further reduction to 45 days follows in 2028.

Shorter lifespans mean a stolen or compromised certificate becomes useless sooner — good for everyone.

For website owners: check whether your certificate renewal process runs automatically. Fully automated setups that support ACME Renewal Information (ARI) — a protocol that lets Let's Encrypt signal your system when to renew — should handle this without any changes. If yours is hardcoded to renew a fixed number of days before expiry, update that trigger to roughly two-thirds of the certificate's lifetime so renewals still land in the right window.

Not sure what you're running? Ask your hosting provider — most handle this for you already.

Anthropic has launched OSS Scanner, a free service that uses its AI models to periodically scan open source software projects for security flaws, according to SecurityWeek. Open source software is the foundation of most of the internet, and security flaws in it often go unnoticed for years.

Maintainers opt in, receive a report for each potential vulnerability found, and get a proof-of-concept showing how it could be exploited, plus a suggested fix where one exists. Reports are sent without human review, so Anthropic flags that some findings may contain inaccuracies, though it expects more than 90% to be accurate.

If you maintain or depend on open source projects professionally, this is worth flagging to your development team.

What you should do: Open source project maintainers can opt in at anthropic.com. If you are not a maintainer, raise this service with whoever manages your organisation's software dependencies.

Google has released Chrome 155, patching 247 security vulnerabilities including four rated Critical. All four critical flaws are use-after-free bugs (where a program keeps using memory after it has been freed, allowing attackers to hijack it). None are confirmed as actively exploited yet — but that window closes fast once patches are public.

Updating takes under a minute. In Chrome, go to the three-dot menu in the top right, select Help, then About Google Chrome. The update will download automatically. Click Relaunch when prompted.

Chrome is used by the majority of internet users worldwide. Keeping it current is one of the highest-return security habits available to anyone, at no cost.