Microsoft Plugs Nearly 1,000 Security Holes

Microsoft just patched nearly 1,000 security holes. That's a record-shattering September Patch Tuesday, with fixes for at least 974 vulnerabilities across Windows and other software, and it completely dwarfs the company's previous high-water mark of 570 flaws from July. So this year's running total now tops 2,600, more than double the 1,245 vulnerabilities Microsoft addressed in all of 2020. And the calendar still has three more months of patch releases to go. It's not slowing down.

This month’s release is enormous, and security professionals are already bracing for a logistical nightmare. Microsoft frames artificial intelligence as the engine accelerating vulnerability discovery, but the actual humans responsible for testing and deploying those fixes inside real organizations are confronting something far messier, a grind that no algorithm can solve. It’s unsustainable. Each patch demands verification, compatibility checks, and careful scheduling, and when you stack hundreds of them into a single cycle, the workload crushes even the most seasoned teams. So they’re stuck. They can’t keep up, and they don’t see a way out.

Two Zero-Days Already Under Attack

The clock is already ticking. Two “zero-day” vulnerabilities patched this month are being actively exploited by attackers right now, which means the danger isn't theoretical or waiting for a lucky break, it's happening in the wild this very second. CVE-2026-81963 and CVE-2026-85880 both let an attacker gain more privileges on a Windows system than they should normally have. That gives them extra control. These bugs demand immediate attention, and we can't afford to look away, since evidence of real-world exploitation means the window for action is closing fast. So patch now.

Fully 113 of the flaws Microsoft fixed today carry its most severe “critical” label. That means malware or a malicious actor could exploit them to seize control of a vulnerable Windows machine, and they can often do this with little or no help from the user. For organizations that lag on patching, these critical flaws are the most direct route to a full system compromise. So don't wait. And if your team hasn't updated systems yet, it's a race you can't afford to lose.

A DNS Weakness and a Shell Flaw

CVE-2026-69730 is a serious DNS vulnerability, and it hits Windows Server 2012 and later versions, plus Windows 10. It's nasty. Microsoft warns that an unauthenticated attacker can exploit this weakness by sending a single specially crafted packet to an affected system, which means no credentials or prior access are required to trigger the flaw. So the company flags this bug as likely to be exploited, putting it near the top of any remediation list. Don't wait on this one.

CVE-2026-69829 is just as alarming. It's a critical remote code execution flaw in the Windows Shell, and it carries a CVSS base score of 9.8 out of 10, which firmly plants it in the “patch immediately” category. The exploit demands low attack complexity, zero privileges, and no user interaction. So an attacker could trigger it with minimal effort. They don't need any social engineering tricks, and that's what makes this threat so dangerous for every unpatched system out there. Patch now.

The AI Trade-Off Nobody Mentions

Microsoft isn't alone in this trend. Adobe, Cisco, Google, Mozilla, and Oracle have all recently credited AI-assisted research with boosting their patch cadence and volume, a shift that reflects how automation now lets companies push fixes faster than ever before. But Google announced today that it will now ship security updates every two weeks. That schedule would've seemed exhausting just a few years ago. So the pace has changed, and it's not slowing down.

AI is finding more vulnerabilities, sure. But the bottleneck has shifted downstream, and that's where the real friction lives now. Tyler Reguly, associate director of security research and development at Fortra, points out that deploying Windows updates requires careful testing before installation across an organization because third-party software doesn't always play nicely with changes to the underlying operating system, and that friction creates real-world delays. So the discovery isn't the problem anymore. The rollout is.

“It’s time to put our CISOs and CSOs on notice,” Reguly said. “How are you helping your teams through these difficult times? Do you have your teams deploy after hours and on weekends to avoid disruption to the business environment? Do you reward them for that effort? Time to dig into your budget and buy dinner for your teams that are working on Saturday to get patches rolled out before users return to work on Monday.”

The human cost of this patch deluge is real. Security teams are burning weekends and late nights to keep their organizations protected, and the pace is only accelerating, which means exhaustion isn't a temporary blip but a permanent condition that threatens both morale and operational stability. Reguly’s challenge to leadership is blunt. Are you supporting the people doing this grueling work, or just expecting them to absorb the load? So here's the uncomfortable question. It's not sustainable.

Separating Signal From Noise

Satnam Narang, senior staff research engineer at Tenable, offers a more measured perspective on what the rising patch counts actually mean for most organizations. But here's the reality: while the volume of vulnerabilities being fixed by Microsoft is climbing, the number of flaws that can and will affect any given organization remains relatively low, so don't panic over the raw numbers. The key is figuring out which ones matter for your specific environment. It's a filtering problem, not a volume problem.

Narang says AI-assisted vulnerability discovery in 2026 is creating larger haystacks. But it isn't finding more needles. That's the real problem. So it's critical that organizations understand which vulnerabilities actually apply to them, whether those vulnerabilities pose a genuine threat by being reachable and exploitable, and then prioritize their remediation efforts based on that specific risk context, because without that clarity, they're just drowning in noise.

That risk-based approach is easier said than done when hundreds of patches land on the same Tuesday. It's a real headache. But Narang’s point is that not every vulnerability is equally dangerous to every organization, and the visibility needed to sort through the noise quickly and confidently is precisely what makes the whole calculation so tough. A flaw in a service you don’t run or a component you don’t use is, for practical purposes, a non-issue. So the real challenge is knowing that before you waste a single minute.

What Regular Users Should Do

For everyday Windows users, the calculus is simpler. You don't need to test patches before deploying them. But you do need to open Windows Update periodically or accept the program's nag notices about pending updates. They're piling up fast. With patch releases ballooning in size month after month, letting them pile up is a recipe for trouble, and the longer you wait, the more accumulated changes you'll need to absorb at once, so that single giant update can feel like a sudden, heavy burden.

• Enable automatic updates or set a regular reminder to check Windows Update manually.
• For enterprise admins, monitor askwoody.com for reports of updates causing unexpected problems.
• The SANS Internet Storm Center offers a per-patch breakdown ordered by severity and urgency.

Enterprise Windows administrators face a more complex decision tree. Every patch carries risk. They need to weigh the urgency of each update against the chance it disrupts business operations, and they also need reliable sources of information about which fixes are causing problems in the wild, all while juggling a clock that never stops. But the resources exist. Using them effectively demands time and attention, and those are already in short supply, so it's a constant trade-off they can't escape.

The trend line is clear. It points one way, and that way is up. Patch bundles are getting bigger, AI is accelerating the discovery of vulnerabilities across the industry, and the burden of testing and deployment continues to fall on human teams who are already stretched thin. Organizations that haven’t already invested in automation, better patch management processes, and realistic staffing levels will find themselves increasingly underwater. But that record won't stand for long. The next one is only a month away.