Microsoft releases record September patch for Windows
Microsoft issued its largest-ever security update for Windows, addressing over 960 vulnerabilities in its September release. More than 100 of these flaws are rated critical, and at least two are actively exploited. Several issues from previous updates, including failures in Microsoft Teams and Outlook on ARM devices, have been resolved. The volume of fixes is part of an industry-wide trend linked to increased use of AI for identifying software vulnerabilities.
- More than 960 vulnerabilities patched in September
- Over 100 vulnerabilities are critical severity
- Two vulnerabilities are being actively exploited
- Fixed issues with Teams and Outlook on ARM devices
- Patch surge reflects AI-driven vulnerability discovery
Sources covering this
In this story
More in Cybersecurity
Microsoft releases record number of security patches
Microsoft released updates to fix at least 974 security vulnerabilities across Windows and other products, its largest patch release to date. The update includes critical flaws, some already being exploited, and over 100 rated as dangers that could let attackers seize control of systems. The unprecedented volume is partly due to the use of AI for vulnerability detection, but experts warn that rapid growth complicates efforts to test and deploy fixes.
OpenAI pledges $1 billion for AI cyber defense program
OpenAI has pledged $1 billion in credits to help organizations defending critical U.S. infrastructure—including water utilities, electric grids, local governments, banks, and nonprofits—access its AI-powered cybersecurity tools, training, and support. The "Daybreak for Frontline Defenders" initiative aims to help these sectors strengthen their defenses as AI-driven cyberattacks become more advanced. OpenAI says it will expand the program to partner countries in the coming weeks.
Liquid Network exploit creates $320 million in unbacked bitcoin
Attackers exploited a software bug in Blockstream's Liquid Network, a Bitcoin sidechain, creating about 4,000 unbacked Liquid Bitcoin (L-BTC) and withdrawing $320 million. The attackers identified themselves as white hat hackers and have returned most funds, retaining around $47 million. According to Blockstream, the incident did not involve compromised multisig keys but was caused by a vulnerability in recent node software.
Chinese-linked groups shared Chrome and Windows exploit kit
At least four cyber-espionage groups, mostly linked to China, used the same exploit kit called BlueMoon to target U.S. defense contractors, Southeast Asian governments, and NGOs from late August into September. The kit exploited recently patched vulnerabilities in both Google Chrome and Microsoft Windows, taking advantage of the delay between a fix’s public release and its arrival to most users. Proofpoint found the exploit code was identical across groups, but each used its own malware.