Microsoft’s Patching
Microsoft's September Patch Tuesday fixes a record 972 vulnerabilities, 112 rated critical, amid AI-accelerated vulnerability discovery.
Microsoft's September 2026 Patch Tuesday patches a record ~972 vulnerabilities, 112 rated critical, following records of 570 two months ago and ~620 last month. Schneier attributes the surge to AI-powered vulnerability finding, citing an open letter from OpenAI, Anthropic, AWS, Google, Microsoft and roughly 100 organizations warning of an AI-enabled attack tsunami. He predicts AIs will reverse-engineer exploits from patches, weaponizing flaws immediately upon release and shrinking the patch window to 'immediately.'
- Record ~972 vulnerabilities fixed in September; 112 rated critical severity
- Previous records: 570 vulnerabilities two months earlier, ~620 last month
- Open letter from 100+ organizations warns of AI-enabled exploitation tsunami
- Schneier: AI will reverse-engineer patches and weaponize flaws immediately
Full article289 words · extracted from schneier.com · click to collapse
Once a month, Microsoft pushes a security update to all Windows users. Tomorrow’s is a new record:
Microsoft’s patch for September is a doozy, with a record number of roughly 972 vulnerabilities fixed and 112 of them meeting the high critical-severity threshold.
It was only two months ago that Microsoft patched a then-record 570 vulnerabilities. Then, last month, Microsoft patched some 620 of them. Google and other companies have also published record numbers of vulnerabilities in recent months. Two weeks ago, OpenAI, Anthropic, Amazon Web Services, Google, Microsoft, and 100 companies and organizations published an open letter warning of a narrowing window for patching vulnerabilities ahead of an expected tsunami of AI-enabled attacks that actively exploit them first. The industry is taking the threat seriously by pumping out unprecedented numbers of patches in their software.
This is the result of AI-powered vulnerability finding, and a good example of AI helping the defenders more than the attackers.
What will be interesting to watch is how the number of vulnerabilities changes over the next few months. My prediction is that it will continue to increase as the AIs get better at finding software vulnerabilities, and then decrease as they run out of vulnerabilities to find. How high the number gets, how fast the trend reverses, and how quickly it declines after that are all unknown.
And Microsoft is right: The window to patch has shrunk to “immediately.” AIs are also good at reverse-engineering exploits from patches, which means that these vulnerabilities will be weaponized as soon as the update is published.
Tags: AI, Microsoft, patching, vulnerabilities, Windows
Sidebar photo of Bruce Schneier by Joe MacInnis.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.schneier.com/blog/archives/2026/09/microsofts-patching.html