Patch Tuesday used to be a monthly chore. This October it's more like a season finale whose end credits scroll for twenty minutes. Microsoft just fixed 1,413 vulnerabilities in a single release, which is more than it patched in all of 2025.
1,102 Windows Fixes and One Very Real Zero-Day
According to SecurityWeek, the record haul breaks down to 1,102 flaws in Windows, 134 in Office, 61 in developer tools and 36 in SharePoint Server, with Exchange Server, Azure, Defender and others also getting fixes. Microsoft's patch count for 2026 now tops 4,000.
The one to patch first is CVE-2026-96951 (CVSS 8.8), a Windows shell security feature bypass that lets attackers evade Mark of the Web, the tag that tells SmartScreen and Office Protected View a file came from the internet and deserves suspicion. It's already being exploited. CISA added it to its Known Exploited Vulnerabilities catalog on October 13 and gave federal agencies until October 16 to fix it. The attack needs a user to open a crafted file sent by email or instant message, which, historically, users are extremely good at.
AI Found the Bugs. Humans Still Have to Ship the Fixes
SecurityWeek describes the surge as "largely driven by AI," pointing to Microsoft and Palo Alto Networks using AI to hunt vulnerabilities in their own code. That's the good news: every bug a defender's model finds is one an attacker's model doesn't get to weaponize first.
The less glamorous news is that patch processes were never designed for four-digit months. Microsoft seems to know it, introducing "risk cohorts," groups of CVEs that need a similar customer assessment, which it calls "a starting point, not a final decision." Translation: triage is now a core skill, not an afterthought. If AI-assisted discovery keeps up this pace, every IT team and every web team with Windows servers or SharePoint in the stack needs a prioritization process that doesn't depend on someone reading 1,413 advisories over coffee.
The machines have gotten very good at finding problems. Deciding which fire to put out first is still, gloriously, a people job.
When patch volume hits four digits, the hard part is knowing what to fix first, and our team sets up update and triage routines for the platforms behind your website so the critical stuff never waits in line.
Source: SecurityWeek