PowerShell releases three coordinated patches today; two of those lines lose support in two weeks
Microsoft shipped three PowerShell servicing builds today, and two of those lines stop being supported by November 10.
PowerShell is a quiet workhorse of global IT. It runs underneath Active Directory, Azure, SQL Server, Kubernetes tooling, and a mountain of deployment scripts. So when the PowerShell team publishes patches, few people make a fuss, but a lot of production environments get safer.
Today it published three at once.
Between 17:19 and 17:26 UTC on October 25, 2026, Justin Chung put out three new servicing builds: 7.6.9, 7.5.13, and 7.4.22. All three land in about the same minute. All three do essentially the same thing. And two of the three lines they belong to end support in roughly two weeks.
That's the part worth paying attention to.
What today's patches actually do
Per the GitHub release notes, each build records one user-facing change: a bump to a newer .NET SDK. No new engine features. No new cmdlets. Just a runtime refresh. Keep in mind these are servicing updates, not feature drops, so that's expected.
The 7.6.9 build is the largest of the trio, at 39 assets spanning Windows, macOS, and Linux in just about every architecture you might want: MSI and ZIP for Windows, pkg and tar.gz for macOS, plus .deb, .rpm, and MSIX. It runs on .NET SDK 10.0.403, and it's on an LTS line Microsoft keeps supported until November 2028.
The 7.5.13 build tracks .NET SDK 9.0.320 and ships 26 packages. There's no separate "LTS" variant here, since 7.5 is a feature release that doesn't get the extended support treatment.
7.4.22 sits in between at 33 assets, built on .NET SDK 8.0.427. It's a previous LTS line now racing toward the exit.
Here's what makes the timing feel deliberate. Both 7.4 LTS and 7.5 reach end-of-support on November 10, 2026, about two weeks out. After that, Microsoft stops pushing security updates for those lines, and they start showing up as "unmaintained" in vulnerability scanners. The 7.6 LTS line, by contrast, won't switch off until November 2028, having launched on .NET 10 LTS, which Microsoft commits to until late 2028.
Two of the three lines die in two weeks. The third has three years left. That's almost certainly why the team kept everything in lockstep: it hands organizations one last fully patched build on each soon-to-be-dead line, then nudges them toward 7.6.
The commits-since-release-to-master counters on each tag tell a small story alongside this. There are 1,317 commits behind master for 7.4.22, 912 for 7.5.13, and 454 for 7.6.9. Servicing lines run on a deliberately slower, more conservative cadence than the fast-moving master branch.
The security fix that wasn't today's news
There's a confusion brewing that's worth defusing before it spreads.
These did not patch a fresh batch of holes. The real work landed last month.
In October, PowerShell published a security update, the 7.4.21 / 7.5.12 / 7.6.7 trio, on October 13, and that's what closed a batch of serious flaws. The headline was CVE-2026-96251, an RCE rated CVSS 8.8 and tied to CWE-807 (reliance on untrusted inputs in a security decision). The bug hid in Import-PSSession's clobber check, which compared the alias name instead of the resolved target name. A malicious remoting endpoint could export an innocuous-looking alias whose real target was PSConsoleHostReadLine, the function the console host uses to read each input line. The proxy would overwrite that callback, and whatever the server returned would execute in the client's PowerShell process, no -AllowClobber needed and no warning shown.
That issue was reported through MSRC by researcher Coşkun Bağrıaçık in late July, and the final CVE-2026-96251 finding credits ten researchers in total. A public write-up and a proof-of-concept shipped alongside the fix.
Today's builds inherit all of that. They don't re-patch the CVEs. They simply refresh the runtime on top of the October fixes. So the clean line is: October was the security fix. November is the runtime servicing layered on top of those fixes. Don't credit today's releases with the RCE patch.
The Windows PowerShell sibling is also in there: CVE-2026-85817, the same class of fix applied to the in-box 5.x engine, plus CVE-2026-96303, a security feature bypass over standard in. Both closed in the same October build.
For a tool most people never think about, the takeaway is unusually concrete.
Update to today's builds. They're fully patched and on a fresh runtime. Then, if you're still on 7.4 or 7.5, plan the migration to 7.6 LTS before November 10. The deadline is real, and the clock is already running.
All three releases are on the PowerShell GitHub page:
Release v7.6.9 Release of PowerShell · PowerShell/PowerShell
7.6.9 Build and Packaging Improvements Update to .NET SDK 10.0.403 Merged PR 42305: [release/v7.6.9] Update branch for release SHA256 Hashes of the release artifacts hashes.sha256 638E95466...
Release v7.6.9 Release of PowerShell · PowerShell/PowerShell
Release v7.5.13 Release of PowerShell · PowerShell/PowerShell
7.5.13 Build and Packaging Improvements Update to .NET SDK 9.0.320 Merged PR 42303: [release/v7.5.13] Update branch for release SHA256 Hashes of the release artifacts hashes.sha256 3AD34E14...
Release v7.5.13 Release of PowerShell · PowerShell/PowerShell
Release v7.4.22 Release of PowerShell · PowerShell/PowerShell
7.4.22 Build and Packaging Improvements Update to .NET SDK 8.0.427 SHA256 Hashes of the release artifacts hashes.sha256 AA81683B111314FF48083CD6CD757EF795683047FEFC9D06412B36D93046B481 powe...
Release v7.4.22 Release of PowerShell · PowerShell/PowerShell
