End of Support, a Zero-Day and a Certificate Expiry: The Windows Fleet Checklist for October

End of Support, a Zero-Day and a Certificate Expiry: The Windows Fleet Checklist for October

Week of 19 October 2026 | Compiled by Team Paringa

Three separate Microsoft lifecycle events landed in the same week. For anyone running or buying managed Windows endpoints, the question is which devices are exposed and who is accountable for fixing them.

What Happened This Week

🔴 Windows 11 24H2 Home and Pro hit end of support

BleepingComputer reported on 13 October 2026 that Windows 11 24H2 Home and Pro devices have reached end of support, alongside Windows 10 Enterprise LTSB 2016. The October 2026 monthly security update is the last for these editions, and affected devices will no longer get monthly security or preview updates. Microsoft advises moving to Windows 11 26H2, which became generally available in September 2026 as an enablement package. Windows Latest puts that package at about 174KB on x64 PCs, with installation needing a single restart.

Enterprise and Education editions of 24H2 stay under mainstream support until 12 October 2027. BleepingComputer also notes that Windows Server 2022 reached the end of mainstream support on 13 October, with extended support running to October 2031, and that Microsoft warned unsupported Windows versions will stop receiving security updates after next year's Windows Update certificate rotation.

The risk sits with mixed estates. Organisations that bought Pro devices for smaller offices, remote staff or acquired businesses may have machines that are no longer receiving fixes, even though the corporate fleet is on Enterprise licences.

Sources: BleepingComputer | Windows Latest

Run an inventory by edition and build this week. The Home and Pro devices are the ones most likely to be outside your management tooling and most likely to have quietly stopped patching. Because the 26H2 move is a small enablement package, it is a quick win with a short change window for most devices. TruOffice reports fleet compliance by build, so exceptions are visible and owned rather than discovered during an incident.

🔴 October Patch Tuesday: over 1,400 CVEs and an exploited Windows Shell zero-day

Petri reported (published 14 October, updated 16 October 2026) that Microsoft fixed 1,415 CVEs this month, with Petri noting its product table totals 1,414. Per Zero Day Initiative, 80 are rated Critical and two are zero-days. CVE-2026-96951, a Windows Shell command injection (CVSS 8.8) that lets an unauthenticated network attacker bypass a Windows security feature, is confirmed as exploited in the wild. Other notable fixes include a critical QUIC remote code execution flaw (CVE-2026-105016) triggered by a crafted IPv6 packet, and a SQL Server remote code execution issue.

By product family, Windows accounts for 1,102 of the fixes and Office for 134. The Windows 11 update KB5127648 also continues the rollout of updated Secure Boot certificates and fixes a printing failure affecting RAW and Generic Text Only drivers after the August update. Windows Latest adds that it restores domain trust on devices hit by the 14 September emergency update.

Petri's advice is the sensible one: test before wide deployment but avoid long delays, since attackers weaponise new flaws quickly, and back up first.

Sources: Petri | Windows Latest

A known exploited flaw means your patch window is measured in days. Use a ring-based rollout: a pilot group within 48 hours, broad deployment within the week, and a clear exception list for anything that cannot move. The point of managed endpoint services is that someone is accountable for the pace and for the reporting, so ask for deployment percentages per ring, not just a statement that patching is done.

🟡 Secure Boot certificate expiry on 19 October, and PC-to-PC Migration removed

Windows Latest reported that the Microsoft Windows Production PCA 2011 Secure Boot certificate expires on 19 October. Users can check status under Windows Security > Device security > Secure Boot, and some PCs may need a firmware update from the manufacturer. The October update continues the rollout of replacement certificates to eligible devices.

The same update removes PC-to-PC Migration. Microsoft now recommends Windows Backup, which relies on OneDrive. That affects refresh projects that used the tool to move user data between old and new machines. The update also adds a WinRE management plug-in for MDM providers.

Windows Latest does not detail what happens to a device that has not received the new certificates, so check Microsoft's own guidance for your hardware before assuming the impact.

Sources: Windows Latest

Firmware is the part of patching that organisations most often miss. Ask your management provider whether Secure Boot certificate status is part of device compliance reporting, and list which hardware models need OEM firmware updates. If your PC refresh process relied on PC-to-PC Migration, update the runbook now so the next batch of replacements does not stall at the data transfer step.

What IT Leaders Are Dealing With

Lifecycle events are now arriving faster than annual planning cycles: edition end of support, certificate expiry, server mainstream support ending and a record patch month, all within days. Each one needs an inventory-led answer, not a general reminder.

The weakest point tends to be the edges of the estate. Pro-edition devices, firmware-dependent controls and tools being retired by Microsoft are the places where gaps open. IT leaders are asking providers for evidence by device, not summary assurances.

Three Things Worth Watching Next Week

1. Secure Boot certificate fallout - Watch for reports from devices that need OEM firmware updates after the 19 October expiry.

2. Exploitation of CVE-2026-96951 - With one zero-day already exploited, expect further guidance or proof-of-concept activity.

3. 26H2 rollout uptake - Microsoft says the rollout is phased over the coming months. Track how quickly enterprise fleets move ahead of the 12 October 2027 Enterprise cut-off.

Questions? hello@paringa.ai

Paringa and TruOffice help organisations run managed Windows fleets with clear governance, predictable refresh planning and practical AI adoption. We focus on keeping end-user computing secure and cost-controlled while the platform changes underneath. | 19 October 2026 | © Paringa Ltd