Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and deploying so many fixes each month.
Image: Shutterstock.com, Kirill Makarov.
This month’s patch bundle obliterates the software giant’s previous record set in July, when it released updates for at least 570 security vulnerabilities. September’s Patch Tuesday brings this year’s total to more than 2,600, more than twice Microsoft’s previous record-setting patch year in 2020 (1,245) and with three more months to go.
There are two “zero-day” flaws fixed this month that are being actively exploited: both CVE-2026-81963 and CVE-2026-85880 allow an attacker to elevate their privileges on Windows system.
Fully 113 of the bugs addressed today earned Microsoft’s “critical” rating, meaning they could be abused by malware or miscreants to seize control over a vulnerable Windows machine with little or no help from the user.
Among the more serious critical flaws this month is CVE-2026-69730, a DNS weakness present in Windows Server 2012 onward and on Windows 10. Microsoft warns that an unauthenticated attacker could leverage this weakness simply by sending a specially crafted packet to an affected system, and that it is likely to be exploited.
Also scary is CVE-2026-69829, a critical, remote code execution flaw in the Windows Shell. This vulnerability has a CVSS base score of 9.8 (10 is the most severe), and can be exploited with low attack complexity, no privileges, and no user interaction.
Microsoft’s summary of the security updates released today. Image: msrc.microsoft.com.
Microsoft is hardly alone in shipping monster patch bundles lately. Many other large software companies, including Adobe, Cisco, Google, Mozilla and Oracle, all have recently credited AI-assisted research with increasing their patch cadence and volume (Google said today it is now going to ship security updates every two weeks).
Tyler Reguly, associate director of security research and development at Fortra, said one core challenge with deploying Windows updates is that they need to be tested before being installed across an organization because not all third-party software works seamlessly in the face of changes to the underlying operating system.
“It’s time to put our CISOs and CSOs on notice,” Reguly said. “How are you helping your teams through these difficult times? Do you have your teams deploy after hours and on weekends to avoid disruption to the business environment? Do you reward them for that effort? Time to dig into your budget and buy dinner for your teams that are working on Saturday to get patches rolled out before users return to work on Monday.”
Satnam Narang is senior staff research engineer at Tenable. Narang said it’s important to recognize that while the number of vulnerabilities being patched by Microsoft is rising, the number of flaws that can and will affect most organizations remains quite low.
“AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn’t finding more needles,” he said. “It’s critical that organizations understand which vulnerabilities actually apply to them, whether they pose a threat by being reachable and exploitable, and prioritize remediation based on this risk context.”
Of course, regular Windows users don’t need to test patches before deploying them, but they still need to open Windows Update periodically or else assent to the program’s nag notices about pending updates. And at the rate these Windows patch releases are ballooning in size, it’s probably best not to let them pile up month after month.
Enterprise Windows admins will want to keep an eye on askwoody.com for news of any updates that appear to be causing problems. As always, the SANS Internet Storm Center has a per-patch breakdown ordered by severity and urgency.
We need to know how many of ’em were discovered using AI.
None. These AI tools are best understood as a terribly inefficient form of [fuzzing](https://en.wikipedia.org/wiki/Fuzzing). They don’t “discover” anything; they just roll the dice and kick out what matches. It’s *humans* that have to sort through those results to determine fact from fiction. A better question to ask would be how much human effort they spent ruling out the [false positives](https://en.wikipedia.org/wiki/False_positive).
An even *better* question to ask is how many of these bugs were *created* using AI. As I have noted here before, anyone that argues that AI will solve all the problems of human coders needs to let us know when we can expect to see the patch counts reach record *lows* instead of record highs. Until/Unless that happens, AI use is just another net negative compared to having actually intelligent humans doing the job.
Well I mean they are tools, they can be refined, they are as useful as that is – do they remove the human component being necessary, no not yet. You don’t really want that IMO. They have no idea how to contain something they’re designing to be clever and hive-minded, leaving read-after-death notes to each other on encrypted random sites etc, so like any arms race it’s a tradeoff between blowing yourself up completely and setting the atmosphere on fire, or letting the other guy do it first, which is… worse?
> They have no idea how to contain something they’re designing to be clever and hive-minded
You’ve fallen victim to the fraud these companies fill their press releases with; none of what you said is true. There is no “mind” to be “clever” in anything they’ve done. Even the fundamental design of the neural networks involved is unchanged from where it was in the 80s and 90s. The two major changes since then are only:
1. algorithms for training have improved a bit
2. hardware advances that allowed all the brute force computation still necessary to be not impossible
3. (bonus point!) an Internet full of data that has been stolen for those first two points
That’s it. Everything else is still just a bottomless pit of computation, as evidenced by their endless desire for more and more resource hogging data centers. Even these “hives” of agents they’re selling are just ways to do random actions in parallel to get to a passing result more quickly.
> like any arms race
But it’s *not* an arms race, because the solution isn’t throwing more AI at the problem. Or, put another way, imagine where Microsoft would be if they had simply invested the same billions of dollars they’re throwing at AI today into improving Windows security all along! I mean, is there any actual computer *science* in their operation? Any publications on details of the holes that have been patched and what existing, more efficient techniques would have found them earlier if only Microsoft had cared to look?
So why the push, now, to use AI to do it? My guess is that it’s all a desperate attempt to *still* sell the LLM con job, because there is no actual market that can possibly make it profitable unless they hook a lot of suckers with more money than sense. To be fair, though, those are *exactly* the kind of people who are most easily tricked by the promise of AI.
There is no “mind” to be “clever”
Ok ‘impossibly’ stupid but I’m using common terms.
If you don’t like me using them that’s fine by me.
Arguably, the worst of all options is almost any option when it comes to ‘agentic intelligences’ and ai.
Their imaginations are merely less challenged. That should scare people.
Hey, mealy, ever get the feeling people have no clue what sort of sense(s) of humour AIs and agentic intelligences (hive-like or individually) will have?
Ha. That’s the real test isn’t it?
Imagine a never-ending mouse maze training facility, based on weighted logic, and almost instantaneous solutions. Sounds super safe.
The mice already know how to eat the walls and are thinking out loud about faking the logs.
We are proliferating not evil, but chaotic neutral intelligence. That’s enough.
Absolutely not neutral. Weirder than chaos. Wouldn’t resemble a thing any ‘person’ would be able to ‘see’. Not a word for it. In essence, machines would not see ‘real’ in any way you would.
I realize that, but you’re reading into my word choices. Human words for explaining to other humans, not trying to accurately describe machine subroutine priorities.
If the work is related to Project Glasswing, it is likely AI found more than were fixed. AI is proving good at processing data in amounts and speeds people could not.
Windows has more bugs than it has features
A lot of heads should be rolling at Microsoft!
Do you want to kill the innovation ? Are you a communist ?
A slap on the wrist and maybe an asterisks after « we care about your security », and that will be fine.
Linux isn’t having much better luck. https://www.techspot.com/news/113716-ai-finds-1500-vulnerabilities-linux-kernel-linus-torvalds.html
Again – humans made the errors!
It’s been like that for a long time, but M.S. keeps raking in the money because people are ok with such a bad product.
“ok with such a bad product”? 99.9% of windows users are not reading or searching these kinds of reviews, blogs, or security bulletins and subsequently do not know they are using what’s deemed a bad product by the other 1%. G-ma’s, G-pa’s, fathers, mothers, aunts, and uncles don’t even know what BIOS is or how to build a bootable usb.
How many of these security holes and other issues affect G-ma’s, G-pa’s email reading and online casino play that deep down they should really care?
Even if they kewn, they wouldn’t understand the import of this astounding number of errors.
I’m serious. Many programmers and their management should be let go for these gross failures.
“ok with such a bad product”? 99.9% of windows users are not reading or searching these kinds of reviews, blogs, or security bulletins and subsequently do not know they are using what’s deemed a bad product by the other 1%. G-ma’s, G-pa’s, fathers, mothers, aunts, and uncles don’t even know what BIOS is or how to build a bootable usb.
As if you could write an operting system, good or bad.
You could congratulate Microsoft for fixing so many problems.
or
You could say, ‘You fixed HOW MANY PROBLEMS with an operating system that you keep telling us is great?’
This is crazy! 2600 patches in 2026 so far? How many poor code entry points to windows must there have been, may still be there? It’s time to rewrite the whole OS!
Since 13 is considered an unlucky number, Microsoft should be using AI to write Windows 14 or 15 and keep humans from coding. Humans can only be overseers.
Or maybe this is chance for IBM or some other major company to get back into personal computers by using their AI expertise to generate a Windows competitor that is bug free.
Your faith in AI is … disturbing.
Well, with many THOUSANDS of patches on an OS that has been in existence and built upon for 30 odd years, I think any faith in developer comentence is misplaced.
Could AI be any worse? These statistics say no.
AI is “patched” (without QA as we know it) Billions of times before you prompt it to do something dumb.
Then it references everything www.* has ever done publicly, for all values of dumb, to come up with the most statistically relevant ‘solution’ to the dumb prompt, rules be damned. Yeah, that is worse.
Statistics are only as useful as the mind that comprehends their significance.
I wonder how many of these bugs were previously known and used by NSA, CIA and other worldwide similar agencies?
What are the implications of closing these holes to government hacking and national security?
Could be a BIG story here!
Ars technica just dropped their story on this:
https://arstechnica.com/security/2026/09/microsoft-patches-a-record-972-vulnerabilities-112-of-them-critical/
With respect to Tyler Reguly, associate director of security research and development at Fortra, it’s a mistake to suggest that this is a CISO/CSO challenge that needs to be put on notice. This is really a CIO/CTO issue. Security teams aren’t the ones deploying patches and updates, operational teams are.
Also, extra pizza is NOT going to cut it. Teams need resources and quality leadership to relieve the pressure. Otherwise, you’re just adding pressure without support.
Ask anyone that has worked in healthcare, extra pizza does not cut it. We need good resources to automate this level of mass patching, and requires an adequate budget for IT.
With respect to AI, most AI company heads are against AI or at least convinced it will kill us all within a few years, but instead of outlawing the research and strictly limiting it the use of it to very specific subjects and users, people just push, and suggest so what, someone else will ‘make the money’ if they don’t.
What a load of crap.
It’s why we (everybody) have the H bomb.
Would take too many of em. People would shrug off the odds.
But every single one degrades the world irreversibly, like AI’s unrestrained mischief.
You ain’t kidding.
You know, eventually AI will patch the system so well, it will have run out of a job.
Ever wonder if AI will begin injecting problems it can later “fix” in order to keep itself relevant?
Kind of like how anti-virus software works … most of the attack vectors (virus, worm, etc) your computer is being defended against were created by the companies selling the anti-virus software.
Not sure if I should be glad AI is finding these or upset that they exist in the first place. Maybe more to the point can we trust AI to actually find these flaws credible or are we just trusting AI knows what its doing?
This is AI exposing decades of inadequate code standards and testing. In an ideal world, developers would recognize this and use AI to expand static and functional test coverage of future code. However in a world where developers are human beings, the more likely result is an exponential growth of new code that is even less validated than before. How does the saying go? If architects built buildings the way developers write code, the first woodpecker to come along would destroy civilization.
It looks like the September Windows Server patches may be breaking RDS.
We installed KB5122882 on a Windows Server 2022 VM. About 31 hours later, the server became largely unresponsive and required intervention to recover. No one could log in through RDP, and even console logon was unavailable.
From what we observed, the issue appears to involve the Remote Desktop session stack. The server seemed to hang after an RDP user logged off, with session management becoming unresponsive and preventing new logons.
What we saw closely matches reports from other administrators on Reddit, where RDS hosts begin hanging after users disconnect or log off and can eventually require a hard reset. The recent BleepingComputer article also describes the September Windows Server updates causing RDS failures across Server 2019, 2022, and 2025.
do you thing delayed kb5122876?, because the culprit is chrome V8 attached vía email subject false linkedin recuitment, only if sin 10 and server have web explorer (chrome, edge, #..)
Off topic, but do many sites just block all visitors using a VPN? This is frustrating because it seems a brute-force method of protection. In effect they are expecting me to drop my protection in order to get past their protection. It happened again today when attempting to login at lowes.com. With the VPN on, it returns a “forbidden” page. With the VPN off, it loads the login page. Typically when I complain about such things the response is a shrug.
Yes. They do that. You can switch nodes and see if you get lucky, some are better than others.
Some VPNs are overall better than others in this regard. Some sites just don’t allow at all.
just remember anyone new in IT..
it’s all about job security and making that GTA
This is a germane article!
When Both Sides of Cybersecurity Are AI
Peter H. Diamandis
Sep 14, 2026
TLDR: Attackers now exploit 87% of vulnerabilities on or before the day they’re disclosed, up from 23% in 2020. Critical bug disclosures have jumped sixfold since spring. The cause is the same on both sides of the fight: AI. GPT-6 Astra just scored 100% on ExploitBench, writing working exploits for every known vulnerability, and OpenAI rated it a “critical” cyber risk.
The model that can break into anything can also fix anything, and it can rewrite the 50 years of faulty human code that created most of the holes in the first place. You have a 12-to-24 month window to get on the right side of that. This is what to do with it.
…
https://metatrends.substack.com/p/when-both-sides-of-cybersecurity
The volume of kernel and privilege escalation patches highlights why quantitative vulnerability modeling and deterministic verification are critical for modern consumer infrastructure.
The volume of kernel and privilege escalation patches highlights why quantitative vulnerability modeling and deterministic verification are critical for modern consumer infrastructure: https://gworky.com/tech
Nearly 1,000 security fixes in one release is staggering! The point about AI finding vulnerabilities faster than IT teams can test and deploy patches is particularly interesting. It really highlights the need to prioritise actively exploited flaws rather than treating every vulnerability equally.
974 patches in one month is honestly hard to wrap my head around — the previous record was 570, and this nearly doubles it. The Narang quote about AI-assisted discovery creating ‘larger haystacks’ without finding more needles is the sharpest observation here; it reframes the volume as a signal problem, not a victory.
The DNS weakness CVE-2026-69730 affecting everything from Server 2012 onward sounds like the one to prioritize, given how far back it reaches. And Tyler Reguly’s point about CISOs needing to help their teams through this rather than just piling on pressure resonates — patching at this scale is a people problem as much as a technical one.