Why this month’s Microsoft patch release is a doozy

Why this month's Microsoft patch release is a doozy. However, we have not seen a correlating spike in active exploits—yet. ” Counting the precise number of vulnerabilities fixed in a monthly patch release for Microsoft is never an exact science.

What happened

Skip to content Text settings Story text Size Small Standard Large Width * Standard Wide Links Standard Orange * Subscribers only Learn more Minimize to nav Microsoft’s patch for September is a doozy, with a record number of roughly 972 vulnerabilities fixed and 112 of them meeting the high critical-severity threshold. It was only two months ago that Microsoft patched a then-record 570 vulnerabilities. Then, last month, Microsoft patched some 620 of them. Credit: Microsoft Credit: Microsoft Notable vulnerabilities in this month’s release include two zero-days, CVE-2026-81963 and CVE-2026-85880 in the Windows update service and the Windows Advanced Local Procedure, respectively.

Sources tell me that Microsoft will set another patch Tuesday record today, the third in just a few months. Microsoft typically patches around 100 flaws every month, but in June it set a new record of around 200 fixes. July’s patch Tuesday was even bigger, with Microsoft patching at least 570 security holes, almost triple the number of June’s record-breaking release.

The wider picture

The patch gap has always been a risk in cybersecurity, but with the sheer volume of vulnerabilities being discovered in the AI era, I’m sure we’ll see Microsoft and others warning companies once again to apply patches as soon as they’re released. Two weeks ago, OpenAI, Anthropic, Amazon Web Services, Google, Microsoft, and 100 companies and organizations published an open letter warning of a narrowing window for patching vulnerabilities ahead of an expected tsunami of AI-enabled attacks that actively exploit them first.

“On the one hand, congrats to the security gnomes at Microsoft for being able to patch bugs at this rate,” Childs wrote Tuesday. By Childs’s count, Tuesday’s release patches 972 vulnerabilities, and 997 when counting the porting of fixes for the Chromium browser incorporated into Edge. As automated AI tools and community bug reports have pushed up the volume of patches and updates, Google says that a shorter release cycle makes it easier to manage security fixes.

A shorter release schedule would help keep the “N-day” patch gap — the gap between when a security vulnerability is known and when it gets patched — as small as possible. This is not the first time Chrome has adjusted its release schedule to enable faster patch management. TechMicrosoftNotepadMicrosoft breaks another patch Tuesday recordWindows and security engineers have had a busy summer.

What has been reported

Sources familiar with Microsoft’s security work tell me both of these models have contributed to a record-breaking series of patch Tuesdays over the summer period. As Microsoft uses more and more security-focused AI models to discover software vulnerabilities, the number of flaws that need patching keeps increasing. While Microsoft is issuing an unusual number of fixes, the sheer amount is also putting pressure on businesses that rely on Microsoft’s software to apply the patches as soon as possible.

IT admins typically have to test patches from Microsoft to ensure any fixes don’t interfere with critical business applications. Forza Horizon 6 isn’t racing onto the PS5 this yearMicrosoft is planning to delay the release of Forza Horizon 6 on PS5, according to sources familiar with Playground Games’ plans. Forza Horizon 6 has been hugely popular on Xbox and PC, and the previous instalment of the series, Forza Horizon 5, proved popular on PS5, after Microsoft released it on Sony’s console last year.

Microsoft is getting ready to roll out its memory integrity security feature for Windows 11 to more devices next month. Microsoft won’t automatically enable memory integrity again next month if you’ve already previously disabled the feature.

What happens next

Microsoft slashes Xbox Cloud Gaming to just 15 hours a month for Ultimate subscribers. The Xbox app will arrive on TCL TVs at some point “in the coming months,” which is just in time for Microsoft’s new pay-as-you-go option for Xbox Cloud Gaming in November. Tom WarrenMicrosoftNotepadTechMost PopularMost PopularLG TVs caught spying even when offline or on standbyApple says ‘Fold’ and competitors ask ‘How wide? ’Microsoft breaks another patch Tuesday recordXiaomi’s wide foldable promises more power than Samsung’sThe White House pulls its racist Tetris cloneAdvertiser Content FromThis is the title for the native adMore in TechMeta bets on AI agent Muse to catch up in AI racePusheen’s first game is coming to Apple ArcadeA word with a woman who’s trying to pull off a crossbody phone strapGoogle’s Atlas of the human genome could pave the way for new treatmentsSteelSeries’ pro-grade, wireless Xbox controller sure is expensiveIntel CPUs are reportedly getting a 10 percent price hike in OctoberMeta bets on AI agent Muse to catch up in AI raceRobert HartSep 8Pusheen’s first game is coming to Apple ArcadeEmma RothSep 8A word with a woman who’s trying to pull off a crossbody phone strapAllison JohnsonSep 8Google’s Atlas of the human genome could pave the way for new treatmentsRobert HartSep 8SteelSeries’ pro-grade, wireless Xbox controller sure is expensiveCameron FaulknerSep 8Intel CPUs are reportedly getting a 10 percent price hike in OctoberStevie BonifieldSep 8Advertiser Content FromThis is the title for the native adTop StoriesSep 8Apple says ‘Fold’ and competitors ask ‘How wide? ’Sep 8Meta bets on AI agent Muse to catch up in AI raceSep 8Xiaomi’s wide foldable promises more power than Samsung’sSep 8AI power users claim Anthropic duped them with subscriptions, and they’re taking it to courtSep 8A word with a woman who’s trying to pull off a crossbody phone strapNotifications DrawerSign in to see your notifications or create an account to join the conversation.

Security gnomes are pumping out patches ahead of an expected onslaught of AI-assisted attacks. Google and other companies have also published record numbers of vulnerabilities in recent months. The industry is taking the threat seriously by pumping out unprecedented numbers of patches in their software. In some cases, the bugs were previously addressed or affected non-Microsoft products.

The report has been compiled by The Daily Waves using information reported across arstechnica.com, bbc.co.uk, techcrunch.com, theverge.com. Details are presented according to the information available at the time of publication and may change as authorities, organisers or other relevant parties provide updates.