The embargo for iPhone Duo reviews has broken, which means dozens of reviews have appeared all at once. It’s like sitting in an empty office with all the phones ringing at the same time. No one can answer all of them.

So, what are reviewers saying about Apple’s new $2,000 product? What’s hot? What’s not? And what’s next?

Let’s begin with the criticisms. 

Almost every review I read is critical about the same things: the lack of a telephoto lens on the camera, the decision to use Touch ID, and lagging third-party software support for the device, with some criticism of the FaceTime camera. 

To be fair, one of those criticisms will change as developers build iPhone Duo support for their applications, while others will change in future versions of the device.

A convincing case for foldables

Reviewers seem to agree that Apple has plucked all the best ideas introduced in foldables so far and wrapped them in a highly designed, well-executed, luxurious product they think sets the scene for the next generation of foldable smartphones. As the history of most Apple product introductions shows, first-generation compromises will be overcome.

The iPhone Duo form factor itself, however, seems to be a success.

“For an iPhone user who has never experienced a foldable, I suspect they will be surprised by how quickly the larger display starts to feel useful,” wrote Francisco Jeronimo, IDC vice president, worldwide devices, in a note seen by Computerworld. “Apple has made a convincing case for this form factor. Now comes the next test: turning excitement into availability, adoption and a lasting new chapter for the smartphone market.”

Here’s what the first reviewers have to say

“Masterfully-designed”

“The iPhone Duo is a masterfully designed product that earns its two grand price tag. By borrowing the same aspect ratio as a notepad, it feels compact when folded and expansive when opened up to double in size. It’s crazy thin — just 5.2mm when folded flat — and littered with small design choices that add up to an overwhelming sense of luxury,” wrote Robert Leedham at GQ.

“Hype is justified”

“After a week of testing, I can say that hype is justified. Its polished design and thoughtful craftsmanship, headlined by a unique inner display and hinge design, set a new platinum standard for folding phones, and serve as a shot in the arm of the entire smartphone ecosystem. Needless to say, the Duo is the best foldable phone I’ve tested to date, and the freshest, flashiest phone I’ve used in years,” wrote Stefan Vazharov at Popular Mechanics. 

You may not need it

“If you want the convenience of a larger screen without carrying two devices, the Duo could be a compelling proposition. But if you prefer to use your phone and tablet separately, you’re paying a premium for a folding design you may not need,” wrote Shivali Best at the Daily Mail.

“An incredible piece of engineering”

“It’s hard to overstate just how impressive the whole thing feels in practice. The hinge feels fantastic, the smaller footprint makes it surprisingly easy to carry, and you can unfold it into a 7.6-inch display. It’s an incredible piece of engineering, and even after a week, I’m still impressed by how well the entire package comes together,” wrote Chance Miller at 9to5Mac.

“Satisfying“

“’Satisfying’ is the best way to describe the feeling of repeatedly opening and closing the iPhone Duo. It’s as if Apple inadvertently created a digital fidget spinner — the more I carried around the iPhone Duo, the more I found myself absentmindedly folding and unfolding the phone,” wrote Lance Ulanoff at TechRadar.

Cohesive. Intuitive. Useful

“Thoughtful software integrations … give the Duo’s unique design a practical purpose beyond the novelty. The result is a foldable experience that feels cohesive, intuitive and genuinely useful, which could help win over more people to foldables in general. But I think that broader appeal is still a ways off,” wrote CNET’s Abrar Al-Heeti.

“A little bit like magic”

“If you care about having the fanciest phone, this is the one. It’s a neat little book-like iPhone when folded. But that inner display, once you open it, is the nicest phone display I’ve ever seen. It’s matte and has a 120Hz refresh rate, so when you lay the unfolded Duo on a table, a still image on the display appears solid, like a painting… The transition effect Apple’s designers have conjured for opening and closing the phone does look a little bit like magic,” wrote Mashable’s Stan Schroeder.

“Strong and smooth”

“Early folding phones had creaky hinges that felt grindy and didn’t always open fully. Those pioneering devices led the way, to be sure, and they deserve credit for being first to market with those designs. But none of the four competing folding devices on my desk (all from 2026) have a hinge that feels this strong and smooth,” wrote PC Mag‘s Eric Zeman.

“Worth the wait”

“While the Duo is heavy, expensive and late to the market compared to its Android rivals, it encompasses some of the best tech used by its competitors while also redeeming features that other manufacturers have seemingly left for dead. And even though many apps still need to be optimized to fully take advantage of the Duo’s design, the release of Apple’s first foldable has been worth the wait,” said Engadget’s Sam Rutherford.

“Something magical”

“At the risk of sounding cliche, there’s something magical about using the iPhone Duo. The way it seamlessly transitions from phone to tablet and back again. The fact that you can’t even feel the crease — though it is visible. And the way the software reacts based on the angle of the device,” writes Mark Spoonauer at Tom’s Guide.

My take

Having read these reviews, I don’t think any of them will quell enthusiasm for Apple’s $2,000 device. I also think its introduction will help Apple create a mind shift among consumers, some of whom may recall when the $499 entry-level price Apple charged for the original iPhone was seen as too expensive. 

In this case, by combining premium hardware design with smart software decisions, Apple seems to have created an experience many consumers will value. Even those who don’t will probably spend time snapping the fold on the display units at their local Apple Store, if only to find out if doing so really is “satisfying” enough to spend two thousand bucks on a machine for doom scrolling and taking pictures of the family cat.

I believe Apple has reset the industry and will sell as many of these things as it is able to create. I also look forward to seeing what it comes up with next year. There’s only eleven months — and the many stages of new Apple product rumor — until we find out. That suggests the first well-timed Bloomberg rumor will slip just before Christmastime…

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.

Microsoft expanded its sovereign cloud offerings on Tuesday, adding new security, governance and AI capabilities as customers, particularly in Europe, demand greater assurance over where data is stored, who can access it and how critical services operate during disruptions.

The announcement builds on Microsoft’s ongoing digital sovereignty efforts, assisting organizations in applying appropriate levels of control to each workload rather than forcing a rigid, one-size-fits-all approach.

“Organizations are considering more than where data resides. They also seek to understand who can access and operate their systems, how sensitive digital assets remain protected, which technology dependencies matter most and whether critical services can continue as regulatory, geopolitical, security or network conditions change,” Douglas Phillips, president and CTO at Microsoft Specialized Clouds, said in a blog post.

The developments come amid growing international scrutiny of how global tech providers handle sensitive data and the extent of control customers retain over their digital infrastructure.

“Three factors are driving this, including stricter data regulations, rising geopolitical tensions, and growing AI adoption,” said Pareekh Jain, CEO at EIIRTrend & Pareekh Consulting. “Governments and enterprises want greater control over where their data is stored, who can access it, and whether critical systems can operate during disruptions. For instance, governments and big enterprises in Europe are worried about keeping their important data on an American company’s computers. Europe has proposed a new law that would limit the use of US cloud companies for sensitive government data in many areas. Microsoft is responding to these concerns while competing with local sovereign cloud providers.”

New controls across cloud and AI workloads

Microsoft is introducing the Sovereign Control Panel, a unified Azure portal experience that will allow organizations to assess their sovereignty posture, identify risks and gaps, apply controls, and evaluate workload portability. The panel is scheduled to enter public preview at Microsoft Ignite.

Expanding on Azure Key Vault Managed Hardware Security Module (HSM), which gives customers dedicated protection over encryption keys, Microsoft is now extending control beyond its own infrastructure. External key management with Azure Managed HSM is now generally available, enabling organizations to keep root encryption keys in hardware they own and operate on-premises or through a trusted third party.

In limited preview, Azure Confidential Clean Rooms will use confidential computing to support collaboration involving sensitive data, where participants will be able to analyse shared information while limiting broader exposure of the underlying data.

Microsoft is also expanding Azure Local to bring more cloud capabilities into customer-operated environments. The ability to transition workloads between connected and disconnected states is entering public preview. Additionally, DocumentDB and Blob Storage are entering public preview on Azure Local, while SQL Server on Azure Local is already generally available for connected and disconnected deployments.

On the AI front, Foundry Local is scheduled to become generally available at Microsoft Ignite for connected and disconnected operations on Azure Local. It will support local inference and agentic retrieval in natural language, backed by an expanded model catalog from Microsoft, partner networks, and the open-source community.

To further protect data during processing, Confidential Virtual Machines on Azure Local is now generally available, leveraging hardware-encrypted memory and isolation alongside workload attestation before sensitive keys or data are released.

While these additions give enterprises greater flexibility, industry analysts emphasize that localized deployments do not automatically erase vendor dependency.

“Depending upon the deployment model, in the public cloud, enterprises get better visibility, stronger access controls, and more control over encryption keys,” said Ashish Banerjee, senior principal analyst at Gartner. “In the Sovereign Private Cloud, they can operate infrastructure locally and even disconnect selected workloads from Azure. But I would not call this complete control. Enterprises still need to check whether Microsoft remains involved in identity, software updates, management, or technical support for the services they use.”

The article originally appeared on CIO.

European oversight and partner options

For customers in the EU and the European Free Trade Association (EFTA), Microsoft is rolling out Data Guardian. Under this model, a trusted regional partner will provide independent oversight of remote access requests by Microsoft engineers. Simultaneously, a Production Touch Ledger will create tamper-evident logs of all technical actions performed.

Microsoft is also broadening its Sovereign Partner Ecosystem, highlighting regional operators like Bleu Cloud in France and Delos Cloud in Germany, alongside independent software vendors specializing in security, identity, observability, and backup.

Geopolitical realities and market limits

Despite these additions, analysts note that technical controls cannot eliminate geopolitical dependence entirely. US hyperscalers (Amazon, Google, and Microsoft) continue to account for roughly 70% of the European cloud market, whereas European providers’ market share has contracted over the last decade.

The new measures introduced under Microsoft Sovereign Cloud do reduce risks but cannot eliminate them. “Local infrastructure, independent encryption keys, and disconnected operations make it harder for external parties to access data or disrupt services. However, Microsoft remains subject to applicable US laws, sanctions, and export restrictions. Enterprises gain greater operational independence but not complete legal or technological independence,” added Jain.

Furthermore, while sovereign cloud capabilities can offer greater control over data, infrastructure, and operations, this often comes with trade-offs in cost, performance, scalability, and access to services.

Banerjee noted that sovereignty should be assessed workload by workload, rather than applied as a label to the entire cloud environment. Greater sovereignty generally comes with greater cost and responsibility. Local or disconnected environments may not receive every Azure service at the same time. Enterprises may also need dedicated infrastructure, specialist skills and separate continuity arrangements. On top of that, they may lose some elasticity and economies of scale.

“So, I would not recommend maximum sovereignty for every workload. Reserve it for workloads where the legal, operational or geopolitical risk genuinely justifies the additional complexity,” added Banerjee.

The UK wants to take a chunk out of Apple Pay, as the Competition and Markets Authority (CMA) moves to force Apple to open access to its 12-year-old contactless payment system to rivals.

The regulator has published a consultation document that proposes requiring Apple to allow competitors to use the near-field communication (NFC) chip on its devices to enable alternative payment systems on iOS  on “fair, reasonable, transparent and non-discriminatory terms.”

The regulator says action is required because UK businesses have complained that Apple’s existing NFC access arrangements are not commercially viable.

30% of UK adults use Apple Pay?

The regulator also revealed some interesting statistics concerning use of contactless tech in the UK:

• Contactless payments represent 39% of all payments, compared to just 3% of transactions a decade ago.
• 62% of adults currently use a digital wallet.
• 50% of those use Apple Wallet — which implies that around 30% of UK adults use Apple Pay.

“These proposals open the door to more innovation, more choice and economic growth, including in the UK’s important fintech sector,” said Sarah Cardell, chief executive of the CMA.

It’s not clear if those companies will take advantage of this forced liberalization. The CMA tells us that the only services that have done so in the EU, where Apple has already been forced to open up NFC, have all been transnational entities, including Vipps, PayPal, Klarna, Curve, and BBVA. Are consumers flocking to these services to rejoice in this new market liberalization? While this open NFC has only been in place a few months, I don’t think so.

Who will really benefit from this?

Cardell also said, “By removing barriers to entry, we can help create the conditions for brilliant British businesses with great ideas to develop new products and services here — from payment apps and digital IDs to travel passes and digital keys.”

That seems highly speculative to me, but I can see UK banks offering up digital payments directly via Apple’s NFC as the most likely outcome of the new rule. In a statement, David Geale, executive director for consumers, payments and competition at the Financial Conduct Authority, said, “Opening up this technology will also support the expansion of open banking, enabling more people to make payments directly from their bank accounts.”

I imagine the banks will turn out to be the real motivation here. To my mind, it suggests the sector wants to use regulation to muscle in on the ecosystem Apple has made and wants to make direct use of NFC on iPhones to cut Apple out of the revenue generated by these payments as much as possible. 

The CMA admits, after all, that part of the reason it began this work was because it had complaints from competitors. Lenders and fintech businesses have challenged the 0.15% fee Apple takes on credit card transactions carried out via Apple Pay. The inference isn’t hard to see. With 39% of all payments made by adults in the UK being contactless, those tiny payment processing fees look like profit to banking shareholders, and they want it back. 

Apple responds

They won’t get it all back. Even the CMA concedes that Apple deserves a “fair reward” for providing access via its platforms and ecosystem, but I doubt it will hang onto as much as it makes now.

In a statement, Apple said, “We do ⁠not believe the CMA should require Apple to adopt an approach with lower privacy and security protections. We will continue to engage constructively to reach an outcome that is in the best interest of our users.”

Privacy or profits?

Digging a little deeper, the proposals will demand technical changes from Apple. The two main globally used contactless technology standards are secure element (SE), which stores information on-device, and host-based card emulation (HCE), which stores data off-device. 

Neither technology was developed by Apple, and both are used across other mobile ecosystems. While Apple now supports HCE and SE in the EU to meet Digital Markets Act regulation, it has historically avoided supporting HCE to protect the privacy and security of customers. That is almost certainly because it sees risks in storing highly confidential payment data off the device. 

Payments on Apple’s devices are instead protected by secure element. European developers wanting to use NFC with HCE systems must apply for a specific Apple NFC/HCE entitlement and meet technical, security, and regulatory standards, which will likely be the approach Apple takes in the UK if the CMA gets its way.

Will consumers really benefit from this? 

I doubt it, but the move will almost certainly prise some money out of Apple’s grasp, which will then be shared among other corporate entities, some — though probably not all — of whom may even value customer privacy as much as Apple does. In the end, it’s all about the money, and someone will take a slice of it. Does it really matter who that is?

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.

Microsoft’s October 2026 Patch Tuesday is the year’s largest release, with 1,408 CVEs requiring customer action, 72 of them rated critical. September, the previous high, carried 963. One CVE is already exploited: CVE-2026-96951, a Windows Shell flaw that bypasses Mark of the Web. Two were publicly disclosed before release, in the .NET Framework and the MessagePack-CSharp library. Separately, on 25 September Microsoft reported attacks against CVE-2026-65660, a SharePoint Server flaw fixed in August. Readiness recommends a Patch Now scheduling for Windows, Office, Exchange and the developer tooling, and a standard release schedule for SQL Server. The Readiness team has published an infographic summarising deployment risk by product family.

Known issues

On 14 October, Microsoft added a known issue to this month’s Windows 11 updates, KB5127648 for versions 24H2, 25H2 and 26H2, and KB5127646 for 26H1. Non-admin users might be unable to open Remote Desktop connections to devices that have Administrator protection enabled, with error 0xC000000D. The issue started with September’s non-security preview update. The Windows 11 security baselines enable Administrator protection by default, so test remote access to managed hosts before broad deployment. Microsoft’s mitigation is to turn off Administrator protection temporarily through your policy management tool, and a fix will follow in a future update.

Two issues remain open:

• Some USB Audio Class 1.0 devices might fail to start or produce no sound. The 14 September out-of-band update resolved part of this, and for the remaining symptoms Microsoft directs IT administrators to Microsoft Support for Business.
• Windows Server Update Services still does not display synchronisation error details on Server 2025 and Server 2022. Microsoft removed the function to address CVE-2025-59287 and offers no workaround.

And three are now closed:

• The incorrect “Microsoft Defender Antivirus is turned off” notifications, still open when we published in September, were fixed by Defender Antivirus update 4.18.26080.4, released on 17 September.
• On Windows 11, the October update fixes Explorer failing to start after sign-in on multi-user systems such as Azure Virtual Desktop with FSLogix, which left users at a black screen.
• On Windows 10, Windows 11 23H2 and Server 2016 and 2019, it fixes File History failing to back up or restore and showing a false “Reconnect your drive” message.

Major revisions and mitigations

Between the September and October releases, from 9 September to 12 October, Microsoft’s Security Update Guide notifications covered 111 entries for Microsoft’s own products, not counting Chromium republications for Edge. Of those 111, 90 are true revisions rather than new entries. September’s window had one.

• On 17 September, 84 of September’s CVEs gained Office for Mac updates. Each revision note tells customers running affected Mac software to “install the update for their product to be protected”.
• On 16 September, Microsoft corrected the scoring of three critical SQL Server remote code execution flaws from September, CVE-2026-67378, CVE-2026-67631 and CVE-2026-67643. The scores now record that “an attacker does not require any privileges”. Microsoft calls this an informational change.
• On 25 September, Microsoft revised CVE-2026-65660, a SharePoint Server remote code execution flaw fixed in August, to state that it “had reliable evidence of observed attacks against exploitation of this vulnerability”. CISA added it to its list of known exploited vulnerabilities the same day. The Security Update Guide still shows “Exploited: No” for this CVE, so a report filtered on that flag will miss it. If any SharePoint server lacks the August update, install it now.
• Of the 21 new entries, 18 are critical cloud-side flaws in Azure, Microsoft 365 Copilot, Dataverse and Fabric, all marked “Customer action required: No”. Two are Edge flaws, and one is CVE-2026-96940 in Exchange Server, published on 2 October and covered below.

Microsoft has published no mitigations and no workarounds in the October release.

Windows lifecycle and enforcement updates

These support milestones passed with this release on 13 October, as scheduled:

• Office 2021 retail and Office LTSC 2021, including Skype for Business LTSC 2021, reached the end of support.
• Windows 10 Enterprise 2016 LTSB and Windows 10 IoT Enterprise LTSB 2016 reached the end of extended support.
• Extended Security Updates for Windows Server 2012 and 2012 R2 ended. Year three was the last, so the October update is the final one for both.
• Windows 11 Home and Pro version 24H2 reached the end of updates.
• Windows Server 2022 moved to extended support, which runs to 14 October 2031.

The next milestones fall on 10 November 2026, the date of November’s Patch Tuesday. .NET 8 and .NET 9 reach the end of support, as do PowerShell 7.4 and 7.5. Windows 11 Enterprise and Education 23H2, and IoT Enterprise 23H2, reach the end of updates, and Microsoft says November’s update “will be the last update available for these editions”.

Microsoft also starts or tightens several enforcement changes with this release:

• Windows 11 24H2, 25H2 and 26H2, and Windows Server 2025, now restrict NTLMv1-derived credentials for single sign-on by default. Where Credential Guard is off, Microsoft warns this “might affect Wi-Fi, Ethernet and VPN connections that use MS-CHAPv2-based authentication” (KB5066470).
• AD FS Distributed Key Manager container permissions move into enforcement mode. Supported servers remediate automatically, but Server 2012 and 2012 R2 need manual remediation (KB5121391).
• ReFS volumes on removable media enter an audit phase, and blocking is enabled by default from the January 2027 update (KB5130741).
• The Windows Production PCA 2011 Secure Boot certificate, used to sign the Windows boot loader, expires on 19 October. Devices without its replacement, Windows UEFI CA 2023, keep starting and updating normally, but they stop receiving new early-boot protections (KB5062710).

Microsoft’s test guidance for this release runs to 496 Windows entries, 41 of them flagged as high risk, against 466 and 55 in September. Printing, scanning and font rendering account for 31 of the 41. The Readiness team recommends these testing priorities:

• Printing. Print documents with mixed fonts from 32-bit and 64-bit applications to physical and virtual printers. Add network printers by discovery and by IP address, and print through a shared print server, a USB printer and a PostScript driver.
• Downloaded files. The exploited Shell flaw bypasses Mark of the Web, so open files and shortcuts downloaded from the internet and confirm the SmartScreen and security warnings still appear.
• Remote access. Test Remote Desktop with a non-admin account against hosts that have Administrator protection enabled, and test Wi-Fi and VPN connections that use MS-CHAPv2.
• Application installs. Install, repair and uninstall a representative set of MSI packages, including packages with script custom actions. Windows Installer takes 38 fixes this month.
• Network servers. Run DNS servers (52 fixes) and DHCP servers (18) under load, and confirm leases, zone transfers and conditional forwarders behave as before.

Each month, we break down the update cycle into product families, as defined by Microsoft, with the following groupings.

Browsers

For the third month in a row, Microsoft’s Patch Tuesday release lists no browser CVEs. Edge security fixes arrived between releases instead. Between 9 September and 12 October, Microsoft published 414 CVEs for Microsoft Edge in the Security Update Guide: 409 republished from Chromium and five specific to Edge. None carries an exploited flag, and no Edge release in that period reported an exploit in the wild.

Microsoft Windows

Windows takes 1,122 CVEs this month, 42 of them critical. Elevation of privilege accounts for 617 entries, information disclosure for 200 and remote code execution for 179. Of the 42 critical entries, 31 are remote code execution, nine are elevation of privilege and two are spoofing.

• The exploited flaw is CVE-2026-96951, a Windows Shell security feature bypass that evades Mark of the Web defences. An attacker must convince a user to open a crafted file or follow a link. CISA added it to its list of known exploited vulnerabilities on 13 October, with a remediation date of 16 October.
• DHCP takes 18 fixes, six of them critical remote code execution: five in DHCP Server and one in the DHCP client. DNS Server takes 52, 10 of them remote code execution, though none is critical. Critical remote code execution also affects Hyper-V, Message Queuing, Microsoft QUIC, the Remote Desktop Gateway, Windows Deployment Services, Active Directory Domain Services, NDES and the multicast transport driver.
• In file and image handling, the Raw Image Extension has three critical fixes, one of them a CVE assigned by Cisco Talos, and the PostScript printer driver takes three more. Text shaping takes two, and Media Foundation, the codecs library, the video decoder, GDI+, the graphics component and the Windows PDF component take one each.
• The virtualisation-based security enclave takes eight fixes, five of them critical elevation of privilege.
• The most-patched areas are DNS Server at 52, Win32k at 48, the Windows Kernel at 46 and Windows Installer at 38.

Add this Windows update to your Patch Now schedule. Every client needs the fix for the exploited Shell flaw, and DHCP servers and Hyper-V hosts need the critical server-side fixes.

Microsoft Office

Microsoft released 180 Office CVEs this month, 26 of them critical, and remote code execution accounts for 107.

• Client updates on Windows are Click-to-Run only, for Microsoft 365 Apps, Office LTSC 2021 and Office LTSC 2024. Office for Mac updates ship in the same release this month, rather than nine days later as they did in September. Excel takes 69 fixes, 11 of them critical. Word takes 22, Access 13, Outlook 10 with five critical, PowerPoint nine with four critical, and Visio three, all critical.
• SharePoint Server Subscription Edition takes 34 CVEs in KB5002927, two of them critical. SharePoint Server 2016 and 2019 left extended support on 14 July 2026, and two of this month’s flaws list them as affected with no update: CVE-2026-69943 for both versions and CVE-2026-97783 for 2019.
• Office Online Server takes 43 CVEs in KB5002928. Skype for Business Server takes three, in KB5132779 for 2015 CU13, KB5131693 for 2019 CU8 and KB5131692 for Subscription Edition CU1.

Add these updates to your Patch Now schedule, because 25 of the 26 critical entries affect Excel, Outlook, PowerPoint, Visio and Word.

Microsoft Exchange and SQL Server

Exchange has one critical entry this month and SQL Server has none.

• Exchange Server has seven CVEs across 2016 CU23, 2019 CU14 and CU15, and Subscription Edition: one critical remote code execution, CVE-2026-70571, five elevations of privilege and one spoofing flaw. Six are fixed by the 13 October updates: KB5128895 for Subscription Edition, KB5128896 for 2019 CU15, KB5128897 for 2019 CU14 and KB5128898 for 2016 CU23.
• The seventh, CVE-2026-96940, was published on 2 October. Microsoft lists it against a separate set of updates released that day, KB5129955 to KB5129958, not against the 13 October updates, so confirm both sets are installed. Microsoft rates both CVE-2026-96940 and the critical entry as “Exploitation More Likely”..
• SQL Server has 22 CVEs, none of them critical: eight remote code execution, seven elevation of privilege, four information disclosure and three denials of service. Each supported branch gets a cumulative update and a GDR: 2025 (KB5126967, KB5128492), 2022 (KB5126934, KB5128493), 2019 (KB5128494, KB5128495) and 2017 (KB5128496, KB5128497).

Exchange goes on the Patch Now list. SQL Server goes on the Schedule list because none of its 22 entries is critical. If September’s SQL Server update is still outstanding, install it first.

Microsoft Developer Tools

Microsoft released 66 CVEs across its developer tooling this month: two critical, 63 important and one moderate. Remote code execution accounts for 18 entries and elevation of privilege for 13.

• Both critical entries also affect Windows. CVE-2026-105016 is a remote code execution flaw in Microsoft QUIC that needs no authentication or user interaction, and it affects .NET 8, 9, 10 and 11 on Windows and Visual Studio 2022 and 2026. CVE-2026-96222 is an AD FS certificate validation flaw that Microsoft lists against both the .NET Framework and Windows Server.
• Two entries were publicly disclosed before release. CVE-2026-108398 in the .NET Framework lets an authenticated attacker bypass Windows Defender Application Control. CVE-2026-92707, a denial-of-service vulnerability in the MessagePack-CSharp library assigned by GitHub, affects Visual Studio and the ASP.NET Core SignalR MessagePack protocol.
• Visual Studio Code has 10 fixes, five of them security feature bypasses, and PowerShell 7.4, 7.5 and 7.6 take two.

Add these updates to your Patch Now schedule, starting with the .NET updates that carry the QUIC fix.

Adobe (and third-party updates)

Adobe published 11 security bulletins on 13 October, covering 175 CVEs across ColdFusion, Experience Manager, Commerce, Photoshop, Bridge, FrameMaker, Dimension, the Substance 3D tools and the Content Credentials SDK. None is rated priority 1, and Adobe is not aware of exploits for any of them. No Acrobat or Reader security update for this month. I mentioned last month that we are in for a few months of extraordinary patch releases. Harking back to 2003 (when I started work on the nascent field of Microsoft patch management), with Microsoft releasing just  51 updates, anything over a 1000, much less 1400 CVE entries would have been unimaginable. I don’t think that we are at a “patch maximum” yet — but I hope that things calm down soon.

Welcome to the week Apple showed us how serious it really is about artificial intelligence on Macs, with the company making more moves to deliver the tech in the most cost effective, responsible way. While it’s true that today is iPhone Duo pre-order day, that’s arguably not the big news. 

It is not the big news because Apple this week made huge steps in AI. Not only have its researchers come up with a nifty tool to turn Macs into distributed inferencing data centers, not only does the company now have a plan for Apple Intelligence in China, but it has also worked with Meta to make it possible to run on-premises instances of Muse Spark Open on a couple of Mac Studios. Its machine learning team also introduced a new version of MLX that enables AI researchers and developers to run large language models (LLMs) locally on Mac Studio with Apple silicon. 

What’s new to MLX from Apple?

In case you’d missed it, MLX leverages the unified memory architecture of Apple silicon, which is invaluable if you want to build new inference and fine-tuning methods. Over the past year, the ML team has worked on “several key innovations” to make it easier and more efficient to “run state-of-the-art LLMs locally on recent Apple silicon.”

These improvements include:

• Software support for the Neural Accelerators in the GPU of the M5 family of chips
• Low-latency communication across several Macs using Remote Direct Memory Access (RDMA) over Thunderbolt
• Efficient implementations of recent popular architectures such as mixture of experts (MoE)

The release leans heavily into what Apple’s teams have been doing with Muse, and once again demonstrates how the very architecture of Apple silicon supports AI inferencing. That’s no surprise to anybody at this point: not only have I been banging on that drum regularly, but almost anyone who is anyone in AI development and research already works on a Mac.

LLM inference with MLX on Mac Studio

A new white paper from Apple’s machine learning team shares what it has been doing with MLX, along with significant statistics concerning how well its systems support Muse Spark Open, Meta’s new open-weight frontier model. 

“On a cluster of four Mac Studios, Muse Spark Open generates over 36 tokens per second, well above average human reading speed,” they said. 

That’s impressive. It means for the cost of four Mac Studios, a business can run a full-strength, frontier-class model with almost a trillion parameters, on-premises, securing company data while extracting whatever benefits there are to be extracted from the use of it.

Mac Meta matters

Apple and Meta collaborated on making it possible to run Muse Spark Open AI models on Macs. It’s a shrewd move for both companies, given the growing desire to run powerful AI models locally rather than in the cloud. As a result of this work, it’s possible to use Muse Spark Open on two or four Mac Studios to engage in all kinds of agentic tasks. 

Commenting on this on X, new Apple CEO John Ternus wrote: “Amazing to run a model of Muse Spark Open’s caliber and scale this efficiently, right from your desk. Mac Studio keeps pushing the boundaries of on-device AI!” 

Meta’s AI chief Alexandr Wang pointed out that this is in part made possible by Apple’s Unified Memory architecture, which can provide sufficient memory to run these models.

Your Macs. Your supercomputer

“Apple’s unified memory architecture lets the M5 Ultra’s integrated GPU use up to 512 GB per Mac Studio, so two machines can hold an entire model,” Meta explained. “And the chip’s 1.2 TB/s of memory bandwidth is fast enough to read the small slice each token needs. The result is two Mac Studios behave like one supercomputer with a terabyte of unified memory.”

Meta says it tested the system using agentic workflows running entirely on-device, including applying bug fixes and new features to an open-source Mastodon client and driving DaVinci Resolve to review footage and transact tasks. The use of DaVinci Resolve makes this commentator curious, given that Apple is expected to introduce new pro Macs this month. The idea that you may be able to run tasks like this on other Macs will surely be something Apple’s developers are thinking about.

One more thing

Step by step, Apple is defining the playground for AI. In doing so it is attempting, as Greg Joswiak, Apple’s senior VP of worldwide marketing, told TIME, not to make AI for “the lunatic fringe,” but to create an ecosystem for artificial intelligence that will actually help people — a strategic approach that, if it comes together, will help maintain Apple’s position at the intersection of computing and the liberal arts.

(Read my Mac Studio review here.)

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.