Microsoft Patches More Than 1,400 Security Flaws

Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch batch dwarfs September’s record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond. Just one of the weaknesses patched this week is considered a “zero day,” or already exploited in the wild. CVE-2026-96951 is a security feature bypass in the Windows Shell that affects Windows 10 and 11 systems, as well as some Server versions. Windows 10 users might be wondering if they can still expect security updates after this month. Microsoft had been slated to stop shipping updates for Windows 10 systems in October 2025, but ended up adding another year of free updates after considerable pushback. A few months ago, Microsoft quietly extended that support for another year (until October 2027). At least 78 of the flaws fixed this month are rated “critical,” meaning they could be exploited with little or no action by the user, and most of those critical bugs allow an attacker to execute code of their choice on the vulnerable system. While Microsoft said there are no signs anyone is exploiting it yet, a security feature bypass in the .NET Framework (CVE-2026-108398) was publicly disclosed prior to today, potentially giving attackers advance time to work out how to exploit the bug. Satnam Narang at Tenable said the number of flaws fixed this month far surpasses the previous record-setting year 2020, when Microsoft patched 1,261 CVEs. “We’ve now crossed the 4,000 CVE mark with two months left to go,” he said. Microsoft credits large language models for the high volume of bug discovery, and presumably AI gets credit for many of the patches used to fix these flaw. Meanwhile, security experts have been warning that these unusually large patch volleys from Microsoft are placing extra strain on corporate security teams, which often have to test individual updates before deploying them across a network to ensure the fixes don’t cause problems for other software. Tyler Reguly, associate director of security research and development at Fortra, notes that just 26 Microsoft vulnerabilities appeared in the “Known Exploited Vulnerabilities” (KEV) catalog maintained by the U.S. Cybersecurity & Infrastructure Security Agency (CISA) so far this year, and security teams would do well to prioritize patching those 26 vulnerabilities first. “Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act,” Reguly said. Which vulnerabilities deserve the most scrutiny in your organization? The folks at Cisco Talos have a useful roundup of the more noteworthy flaws that Microsoft fixed today, and of course the SANS Internet Storm Center has a reliable roundup that indexes vulnerabilities by severity, CVE number and affected software. One has to wonder how big the backlog of flaws is at this point. Maybe this month’s increase in the number of fixes just reflects an increasing number of people working on these fixes, and that they already have enough flaws to keep them all busy for a long time. Oh to be a fly on the wall. Why do I still own and use a computer for my business? For every invention, product, or process that man creates, several other problems are created for him. There never seems to be an end. I am glad that humans are actually testing the vulns that are discovered by LLMs, but for how long will that be the case? How long until the LLMs themselves well be checking there own vuln discoveries, testing and deploying with no human involvement……. Fred: It comes down to basic Human Nature; biologically, we are still pretty much the same as our ancestors 0f 100,000 years ago. When the internet came along, what we did with it was pretty much what we did with nearly any new invention since then: 1. Get very excited about it 2. See if we could either: A. Stick it in our shorts B. See if it could be made a good weapon C. Amuse ourselves with it to the point of unconsciousness with it, or D. Enrich ourselves with it. Unfortunately, ancient humans, when they picked up a rock, thought first about who they could bash over the head with it, not build a hospital. I exaggerate a bit to make a point. We’ve come a little way since then, but that old hard-wiring is hard to erase. I imagine that, AI being made in our own image, will follow a similar course if not VERY strictly overseen. Note: An old philosopher said that if we ever did produce something like an AI android, we would very shortly be very, very ashamed of ourselves. Fred: It comes down to basic Human Nature; biologically, we are still pretty much the same as our ancestors 0f 100,000 years ago. When the internet came along, what we did with it was pretty much what we did with nearly any new invention since then: 1. Get very excited about it 2. See if we could either: A. Stick it in our shorts B. See if it could be made a good weapon C. Amuse ourselves with it to the point of unconsciousness with it, or D. Enrich ourselves with it. Unfortunately, ancient humans, when they picked up a rock, thought first about who they could bash over the head with it, not build a hospital. I exaggerate a bit to make a point. We’ve come a little way since then, but that old hard-wiring is hard to erase. I imagine that, AI being made in our own image, will follow a similar course if not VERY strictly overseen. Note: An old philosopher said that if we ever did produce something like an AI android, we would very shortly be very, very ashamed of ourselves. I can’t wait for Kill Switch(´；ω；｀) I tend to disagree with the statement that the large number of CVE’s are placing strains on IT teams in terms of patch prioritization. That’s not the issue. For most vendors, Microsoft included, a single cumulative security update is issued, or a small handful for core products (Windows, Office, .Net). Whether those updates patch 100 or 10,000 individual CVE’s, the number of updates to test hasn’t really changed all that much. What HAS changed is the potential for the update to break things since more code is being modified with each update. Testing and deployment processes haven’t changed; it’s the monitoring for unexpected behavior during the testing phase that has become the pain point. I agree. In my experience, for office workers, it’s low risk that patches will brake things. The factory floor is different. But even there, it’s not unusual to find PC’s running equipment not connected to the network due to the fact that they have to run proprietary software that won’t run on modern versions of Windows, or the PC-equipment interface is through a ISA or other legacy cards that modern versions of Windows do not support, and there is no way other than air-gapping to keep them secure. That’s why there are entire companies like NIXSYS (https://nixsys.com/) that build legacy computers using old CPU’s, old glue-chips & busses, and even old versions of Windows. No one junks a perfectly good but ancient CNC because it’s ancient PC died. So, what’s the patch record for Linux? search says patches published anywhere from 5~10 days after public notices are posted, not easy to match Microsoft’$ record… Should we call it a vulnerability if no attacker has any interest in it? I’m seeing a flood of vulns getting patched, but I’m not seeing a flood of vulns causing breaches… Yes. If someone can make your mom stop, cry, and fork over a twenty to an animal shelter talking about puppies in a subway station, that is still a vulnerability of your mother, even if she is fortunate enough not to be approached on any one single given day of her daily commute.