Microsoft releases record number of security patches
Microsoft released updates to fix at least 974 security vulnerabilities across Windows and other products, its largest patch release to date. The update includes critical flaws, some already being exploited, and over 100 rated as dangers that could let attackers seize control of systems. The unprecedented volume is partly due to the use of AI for vulnerability detection, but experts warn that rapid growth complicates efforts to test and deploy fixes.
- Microsoft patched 974 vulnerabilities, its largest batch yet
- Over 100 flaws rated 'critical' by Microsoft
- Two zero-day vulnerabilities are already being exploited
- AI is accelerating the discovery of software bugs
- Experts warn organizations struggle to keep up with testing
Sources covering this
How it unfolded
- SecurityWeek Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days
- Dark Reading Patch Tuesday Sets Another Record With 974 CVEs
- Krebs on Security Microsoft Plugs Nearly 1,000 Security Holes
- Cisco Talos Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities
- The Record Microsoft posts nearly 1,000 bugs for Patch Tuesday as CISA warns two being exploited
- CyberScoop Microsoft discloses two actively exploited zero-days among 974 vulnerabilities
In this story
More in Cybersecurity
OpenAI pledges $1 billion for AI cyber defense program
OpenAI has pledged $1 billion in credits to help organizations defending critical U.S. infrastructure—including water utilities, electric grids, local governments, banks, and nonprofits—access its AI-powered cybersecurity tools, training, and support. The "Daybreak for Frontline Defenders" initiative aims to help these sectors strengthen their defenses as AI-driven cyberattacks become more advanced. OpenAI says it will expand the program to partner countries in the coming weeks.
Liquid Network exploit creates $320 million in unbacked bitcoin
Attackers exploited a software bug in Blockstream's Liquid Network, a Bitcoin sidechain, creating about 4,000 unbacked Liquid Bitcoin (L-BTC) and withdrawing $320 million. The attackers identified themselves as white hat hackers and have returned most funds, retaining around $47 million. According to Blockstream, the incident did not involve compromised multisig keys but was caused by a vulnerability in recent node software.
BigBear 2.0 phishing campaign hits Microsoft 365 accounts
Researchers at CloudSEK have identified a phishing-as-a-service campaign called BigBear 2.0 that stole over 5,100 Microsoft 365 credentials from users in at least 40 countries. Attackers obtained session cookies and passwords, allowing them to bypass multifactor authentication in hundreds of cases. IT service providers were among the most targeted organizations, increasing the possibility of broader downstream attacks.
Breeze Comet targets Brazilian financial firms with fraud
A group known as Breeze Comet has targeted Brazilian banks, retailers, and e-commerce companies through sophisticated attacks since early 2024, according to Google Cloud and Mandiant. The organization uses malware and voice phishing to access internal payment systems and carry out fraudulent transfers. Google states that Breeze Comet is also using generative AI to develop new malware and may expand operations to parts of Latin America and Africa.