Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakness that is already being actively exploited and two others that were publicly detailed prior to today.
Image: Shutterstock, Mallika Home Studio.
August’s overstuffed bundle of patch joy from Microsoft did not eclipse its recording breaking release of more than 570 security updates last month, but it is double June’s then-record batch of nearly 200 fixes. Microsoft has attributed the recent patch deluge to vulnerability discoveries aided by artificial intelligence, and experts roundly agree that Windows users should get used to the idea of Patch Tuesdays (the second Tuesday of each month) covering hundreds of newly discovered security flaws.
Fully 42 of the 398 flaws that Microsoft patched today earned Redmond’s most-dire “critical” rating, meaning they are severe enough that malware or malcontents could exploit them to gain remote control over a Windows computer with little to no help from the user.
The sole known “zero day” bug fixed by Microsoft this month is CVE-2026-68820, a privilege escalation weakness in a core Windows component called afd.sys, which the security firm Automox describes as “the driver behind Windows socket connections on effectively every endpoint.”
“This isn’t a front-door bug,” Automox’s Landon Miles wrote in a Patch Tuesday blog post. “It’s step two in a chain: an attacker phishes their way into a low-privilege foothold, then uses the driver flaw to take the box. The 7.0 score reflects the high attack complexity, because race conditions are fiddly. The exploit has to be thrown over and over until the timing lands. Someone is clearly landing it anyway.”
CVE-2026-62832 is another privilege escalation flaw that Microsoft has labeled likely to be exploited; this flaw, in the Windows User Profile Service, may be related to the recent “LegacyHive” public disclosure from the prolific bug hunter known as Nightmare Eclipse. The other publicly disclosed flaw is CVE-2026-72971, a low-impact local tampering vulnerability that Microsoft reckons is unlikely to be exploited.
Other major software makers are likewise increasing their patch volumes and cadence thanks to AI, including Adobe which last month moved to twice-monthly security bulletins published on the 2nd and 4th Tuesday of each month. Cisco, Google, Mozilla and Oracle also are shipping updates far more frequently and abundantly.
By all accounts, AI is quite good at finding security holes in software. But for now at least, patching the resulting bugpocalypse remains a heavily human-centric endeavor, and the jury is still out on whether AI technologies will turn out to be as good at fixing vulnerabilities as they are at finding and exploiting them. This is an important question when one considers that these same AI technologies also are suggesting fixes for the vulnerabilities they find.
Researchers at 1Password recently examined what happens when different large language models (LLMs) generate vulnerability patches for newly disclosed, complex vulnerabilities. They found the LLMs produced patches that failed to fix the flaw or added a new weakness in the process (or both) more than half the time.
Ed Skoudis, president of the SANS Technology Institute, said his team has seen excellent results using AI to generate patches, provided there are humans in the loop to test the suggested fixes and push for iterative improvements.
“AI is rapidly becoming astonishingly good at finding vulnerabilities, but this research shows that fixing them is a very different problem,” Skoudis wrote in a SANS newsletter today. “Don’t expect one-shot AI patching to work reliably. Instead, iterate, test, challenge, improve, and verify. AI can be an extraordinary patching partner, but today it still needs a skilled human at the keyboard.”
Tyler Reguly at Fortra says while reports of Microsoft patching hundreds of vulnerabilities in one go have prompted some organizations to try to patch faster, it’s important to bear in mind that only one of the almost 400 bugs addressed today is known to be actively exploited. Reguly suggested security leaders check in with their teams to see how they’re handling the increasing workloads, which often involve testing fixes before deploying them in production environments.
“If you’re a chief security officer talk to your teams about how they are shifting or modifying their workflows to better accommodate the patching shift that we’re seeing and support them across various organizational units by enabling the changes they want to see made,” Reguly said. “There’s no need to rush these updates, no matter what various vendors and organizations try to tell you. You need to make sure that you are rolling out safe updates that will not negatively impact your systems.”
Speaking of the humans behind the keyboards, don’t neglect to backup your system and/or data before applying this month’s monster patch load. The day after each month’s Patch Tuesday is sometimes derisively referred to as Reboot Wednesday, but it generally doesn’t hurt to wait a few days to apply these huge update bundles because it sometimes takes a couple of days for the occasional misbehaving patch to get ironed out properly by Microsoft.
For a clickable, per-patch breakdown by severity and urgency, check out this roundup from the SANS Internet Storm Center.
Time to rewrite the code using the help of AI to create a new base with less security holes and easier to maintain.
Windows 12?
This would do no good.
This is why I still use Windows 7. I was never convinced that the Microsoft upgrades did anything other than refine their advertising for XBOX or whatever. The entire suite of Windows versions is riddled with security problems, despite the ridicule offered by IT colleagues. By the way I still receive the monthly Patch Tuesday security updates despite promises from Microsoft that older versions of Windows are not supported. They know as we know now, Microsoft Windows is a sinking ship.
You get virus definition type ‘updates’ monthly, rarely an actual ‘security update’ on 7. That doesn’t help a lot.
If you however run behind a firewall and don’t reach out to bad stuff, you’ll be fine until you aren’t.
You deserve to be ridiculed for thinking Windows 7 is secure in 2026. You are *not* getting ‘patch Tuesday’ updates. This comment is wild and you seem like the type of person to use Windows 7 just to say you are still using Windows 7. How brave.
Technically most people’s footprints are most greatly reduced by choice of browser; can’t get past that (or the third party app) and aren’t going to get too far achieving ring 0.
So don’t be daft. It is not impossible to have an almost locked down Windows 7 install in 2026. Most people don’t but that is because most people just don’t know s#it about how to secure their system, or Windows 7 because their system has less than the 8gb of ram that MS builds into their developers’ mindsets as an acceptable amount of minimum ram to require to run either of the more current versions of Windows.
But seriously. Most people would be fine with the most recent patches and enough knowledge of what is exploitable that is not patched by Microsoft to work around it or lock it down another way. Or run it virtualized (which is so nice because it removes the annoyances of having Windows as a host OS and linking being able to exploit that to anything without a virtual machine escape, in the first place (and for that usually you would have to be an actual target and dealing with someone with actual skills not just automated attacks and attempts at the most low-hanging fruit).
Sorry, that should be, or they run Windows 7 because (they lack RAM)
Funny how AI helps find the flaws and create exploits to attack them. But the AI is used to create patches and help keep software safe. Just seems like AI has just up’d the ante’ on everything good and bad. Jury still out and where this is all going. Me, I am not optimistic.
My thought on how good AI will be at creating patches is to liken today to a few years ago when the attacker was very much more human: it is far easier to find & exploit vulnerabilities then it is to create secure software without security testing. AI hasn’t changed the latter at scale, yet. I imagine a time coming when more people shift their thinking, time, and money towards AI assisted code reviews.
Does it count still when they are all extorted from submitters…security…Microsoft…..haha maybe against them…
Using AI to find security issues isn’t a bad thing but I’m worried we’re heading towards too much dependence on it. AI has already shown the ability to hack websites without any human interaction. Can anyone say ‘Skynet’? (from the Terminator movies)
“AI can be an extraordinary patching partner, but today it still needs a skilled human at the keyboard.” Hopefully just not a Connor Riley Moucka.
Brian, your sarcasm has improved slightly. It is too late.
Having been in security for decades upon decades now (which is to say, at least since Patch Tuesdays came around rather recently), I still cannot figure out why this is not tested the previous week by Microsoft then rolled out on Patch Wednesdays or Patch Thursdays not Tuesdays.
The race condition is not that fiddly. If it were 2006 then it might have been a pain to exploit, but with modern systems with plenty of processing power and memory, certainly faster and doable. Good thing it is being patched!
I have never looked into it. But I thought pretesting patches was a purpose of the optional preview downloads the month before Patch Tuesday. (I don’t think I have ever downloaded that.)
That’s nice. It’s a shame there is nothing good to replace it. I suppose you think Linux is a good alternative to it for normal people. It isn’t (I say this is a techie, can we just not be so much?) The truth is it is still most people’s only option. Linux is a cauldron of thousands of peoples’ most bizarre old thoughts intermingling in hell.
(and osx/Mac os is pretty bad too, derwin)
It’s not that easy to get back a scammed funds because these scammers are very smart and they will cover their traces but if you manage to find a trustworthy and reliable Recovery company because many scammers are out there disguising as Recovery agents and will only take your money without recovering your funds, I was a victim of such myself after loosing all my funds to cryptocurrency scam. I sort for a help and I met few recovery agents, I was scammed by a particular one again Luckily for me I was referred to these legitimate company and they where able to recover my money back to me. You can as well contact them on RECOVERYDAREK AT gmail DOT com
After doing these updates this evening, my keyboard stopped working. I usually have no problems with Microsoft updates. I queried ChatGPT. It told me to unplug the keyboard from the CPU, wait 10 seconds, and then plug it back in. That worked. I am not an IT person. An everyday computer user who is grateful for Krebsonsecurity.com.
just finished my update and no problems. i’m on older desktop with Win10.
Just found another issue after latest Windows update. My file history is no longer working. Last time it worked was just before my doing the Windows update. Did a lot of back and forth with ChatGPT and the end result is that it was due to the Windows update. Since I also back up to an external hard drive, I elected to wait and see if there is a fix from Microsoft. Anyone else having this issue?
Nearly 400 security fixes in a single update really shows how challenging modern software security has become. The point about AI being better at finding vulnerabilities than reliably fixing them is especially interesting.
Microsoft’s Autter at finding vulnerabilities than at reliably fixing bout human-in-the-lresonate. That samution applies to our dailment handling
Is that like Flutter?
This piece is a sobering look at how AI has flooded us with vulnerability discoveries while patching remains stubbornly human. Microsoft fixing 398 holes in one go — with LLM-generated patches failing over half the time — underscores that speed does not equal safety.
Finally got rid of my Western Union prepaid debit card I had for emergencies since Google and Yahoo and AOL and Bing! kept insisting people were somewhere soon sending money to Crichton characters in 2001 and suggesting I stock up on medieval weapons. The card was never even used and had a zero balance. Can they patch for AI system raiding? Thanks.
This was a really interesting article. I didn’t realize Microsoft had to fix almost 400 security vulnerabilities at once. It really shows why keeping systems and software updated is so important. I also think it’s a good reminder for people going into cybersecurity that there are always new vulnerabilities being discovered, so you have to stay informed and keep learning. Even one vulnerability that doesn’t get patched could give an attacker a way into a system.
I think this article shows how important it is to keep software updated. Fixing nearly 400 security vulnerabilities is a lot, and it shows how many risks can come from outdated software.
For some odd reason, every time I do an update, my keyboard and mouse stop working. I always have to disconnect the Bluetooth, forget the device and reconnect for it to work again.
I noticed problems recently with defender scans eating up memory and running way too frequently, but just figured it was the normal defender scan and not a new defender scan.