Why this month's Microsoft patch release is a doozy
ars ·
Microsoft's September 2026 patch release fixes a record approximately 972 vulnerabilities, with 112 rated critical. This surge follows similarly high numbers in recent months and an industry warning about an impending wave of AI-enabled attacks that exploit vulnerabilities. Dustin Childs of the Zero Day Initiative calls the trend the "new normal" and notes that while active exploits haven't yet spiked, the potential for damage is substantial. Notable fixes include two zero-days, a critical Exchange Server flaw exploitable via a malicious Visio attachment, a privilege escalation in Microsoft Authenticator, and numerous SharePoint, SQL Server, and Remote Desktop Services vulnerabilities. Many of the patched flaws are wormable, meaning they can spread automatically without user interaction. The effectiveness of AI-assisted vulnerability discovery is debated, with critics citing costs and false positives, while supporters point to record findings such as Mozilla's Mythos tool discovering 271 vulnerabilities. The long-term impact remains uncertain, but the article suggests skeptics should stay open to the possibility that vulnerability discovery has entered a new phase.
ars