Why this month’s Microsoft patch release is a doozy
Microsoft has released its September patch update fixing a record 972 vulnerabilities, 112 of them rated critical, as the tech industry races to shore up software defences ahead of an anticipated wave of AI-assisted cyberattacks. The scale of the release far exceeds prior "record" months this year, and reflects a broader trend across the industry, with security researchers warning that AI is being used both to discover flaws at unprecedented speed and, potentially soon, to exploit them.
The September figure dwarfs June's then-record 570 fixes and July's 620, and brings Microsoft's total for 2026 to 2,760 vulnerabilities patched, more than double last year's tally and already on course to exceed 2023, 2024 and 2025 combined. The release includes two actively significant zero-days (CVE-2026-81963 and CVE-2026-85880) and, according to researcher Dustin Childs of the Zero Day Initiative, more than 20 "wormable" flaws that could spread between machines without user interaction. The surge follows an open letter from OpenAI, Anthropic, Google, Microsoft, AWS and over 100 other organisations warning of a shrinking window to patch before AI-enabled attacks become widespread, though Childs notes no corresponding spike in active exploitation has yet been observed.
In short
- Microsoft patched a record 972 vulnerabilities in September, 112 critical.
- Surge tied to fears of AI-assisted attacks and AI-aided bug discovery.
- Release includes two zero-days and over 20 wormable flaws.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The record number of fixes shows Microsoft is addressing a large and potentially serious security burden before it can be exploited at scale. With zero-days and wormable flaws among the issues reported, prompt patching and heightened urgency are prudent, particularly as AI tools may help attackers find and use vulnerabilities faster.
The case against
A record patch count does not by itself show that attacks are accelerating or that AI is causing an immediate crisis; the report says researchers have not observed a corresponding rise in active exploitation. The surge may also reflect more flaws being found and disclosed, so presenting it chiefly as evidence of an approaching wave risks overstating what the figures establish.
Explained simply
Microsoft releases security updates, known as patches, to fix weaknesses in Windows and other software. A vulnerability is a flaw that could let someone access a system or disrupt it; some flaws are rated critical because they may pose a greater risk. A zero-day is a flaw attackers may be able to use before a fix is available, while a wormable flaw can spread between machines with little or no user action.
The scale of the fixes has risen across several recent monthly releases, adding to a broader increase in vulnerabilities reported across the technology industry. Security researchers say artificial intelligence may help find software flaws faster and could make it easier to exploit them. That has raised concern about how quickly organisations can install fixes, though researchers have not reported a matching surge in active attacks.