the hacker news
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has come under active exploitation.
These include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to privilege escalation, followed by over 300 remote code
about 4 hours ago
computer weekly
Microsoft CVE volumes on relentless upward trajectory Aided in large part by AI-assisted vulnerability discovery, Microsoft's October Patch Tuesday update has once again addressed a record number of common vulnerabilities and exposures (CVEs), with over 1,400 flaws listed, mor than in the entirety of 2023.
This blows past the previous record of approximately 1,000 set one month ago, which in turn superseded that of a little over 600 set in July 2026. By way of comparison, the October 2025 update addressed roughly 175 CVEs. It is important to note that exact totals often vary and are hard to pin down thanks to the presence of third-party flaws and how they are counted.
Dustin Childs, head of threat awareness at the Zero Day Initiative, conceded that he was starting to think he doesn't much care for the new normal as he described a "breaking point" for enterprise patch management.
When AI can generate essentially a year's worth of vulnerabilities in 30 days, any organisations still cleaving to traditional monthly triage patch management models are leaving their network boundaries dangerously exposed, he explained.
"Hundreds of CVEs in a single release used to be the exception; now it's the baseline. Is AI to blame? Partly," said Childs.
"It's accelerating bug-hunting on both sides of the fence, so vendors are finding – and fixing – more flaws, and researchers are finding them faster too. But AI isn't creating these bugs out of thin air; it's just shortening the time between a vulnerability existing and someone noticing it.
"The volume isn't the real story anymore," he told Computer Weekly via email. "What matters is that discovery is scaling faster than exploitation, so teams that triage by sheer CVE count instead of exploitability are burning cycles on the wrong bugs. Patch what's proven, prioritised, and public, and treat everything else as this month's new normal."
This month, Childs noted in particular the presence of 55 unauthenticated, zero-click vulnerabilities across DHCP, Remote Desktop Gateway, and Network Policy Server – mass wormable attack surfaces that create the "highest lateral propagation risk in years."
High-profile flaws
Diving into some of the more high-profile flaws listed this month, Childs advised defenders to prioritise immediate perimeter ring-fencing to counter an active zero-day command injection in Windows Shell, tracked as CVE-2026-96951, that bypasses Mark of the Web (MotW) protections. This flaw was supposedly discovered in part by Anthropic's Claude AI model and has already made it to the Cybersecurity and Infrastructure Security Agency's (Cisa's) Known Exploited Vulnerabilities (Kev) catalogue.
Also worth close attention, he said, is CVE-2026-102866, an elevation of privilege (EoP) flaw in SharePoint that enables an unauthenticated attacker to exploit a cryptographic token validation issue to take control of user accounts.
Action1 vulnerability research director Jack Bicer said that for security leaders, the challenge this month will not be in simply deploying more updates but in deciding what needs attention first without causing any issues for downstream services.
"This month, the answer depends on more than severity scores," wrote Bicer. "Active exploitation, exposed services, and the role each system plays in your network should guide deployment order."
Sick days for CISOs
Meanwhile, research conducted on behalf of Cardiff-based cyber security consultancy Socura has reported that Patch Tuesday causes major stress among cyber professionals, with nearly a third feeling "significant anxiety" in the days running up to the second Tuesday of the month, and a fifth saying that they had either deliberately called in sick or planned holiday time specifically to avoid having to deal with it.
"You expect your accountant to be available for your tax return deadline, and your lawyer for your court date," said Andrew Kays, Socura CEO.
"It speaks volumes about the unhealthy levels of stress and burnout in our industry that cyber security leaders would deliberately avoid the office during their most consequential day of work. CVE numbers are rising every year and with AI facilitating cyber criminals to exploit vulnerabilities faster than ever, I think Patch Tuesday stress could get worse before it gets better.
"Fortunately, while AI is making Patch Tuesday more difficult, the same AI tools and resources are also in the hands of defenders. AI is improving our customer outcomes, and the time it takes to respond to an incident. And this is the case for many security teams," he said.
Read more about Patch Tuesday
September 2026: Microsoft has released another record-breaking Patch Tuesday update with almost 1,000 flaws in scope.
August 2026: Microsoft's Patch Tuesday deluge continues with August updates (Dark Reading).
July 2026: Another mammoth Patch Tuesday update, likely topping 600 flaws in total, sends defenders into the weeds.
June 2026: Microsoft has obliterated the record for the largest ever Patch Tuesday drop, with its June 2026 update addressing approximately 200 flaws and three zero-days.
May 2026: No zero-day flaws were addressed in May's Patch Tuesday update but as usual there is much for admins to chew over in the coming days.
April 2026: Microsoft's latest Patch Tuesday update may be one of the largest in history, with more than 160 issues in scope.
March 2026: Zero-days in .NET and SQL Server, and a handful of critical RCE bugs, form the nucleus of Microsoft's March Patch Tuesday update.
February 2026: Microsoft releases patches for six zero-day flaws in its latest monthly update, many of them related to security feature bypass issues.
January 2026: January brings a larger-than-of-late Patch Tuesday update out of Redmond, but an uptick in disclosures is often expected at this time of year.
December 2025: The final Patch Tuesday update of the year brings 56 new CVEs, bringing the year-end total to more than 1,100.
November 2025: An elevation of privilege vulnerability in Windows Kernel tops the list of issues to address in the latest monthly Patch Tuesday update.
October 2025: Windows 10 is no longer supported, but that does not mean it is not impacted by the latest Patch Tuesday update.
about 12 hours ago