60
60
60
Microsoft December 2020 Patch Tuesday fixes 58 bugs, 9 are critical
60
Microsoft Releases Patches For Critical Windows TCP/IP and Other Bugs
60
June 2020 Patch Tuesday: Microsoft fixes record monthly number of CVEs
60
60
60
60
60
KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)
Critical CVE-2026-66066 in Rails' Active Storage/libvips allows unauthenticated arbitrary file read and possible RCE; active exploitation now observed.
CVE-2026-66066 (KindaRails2Shell), discovered by Ethiack researchers and independently by RyotaK of GMO Flatt Security, lets attackers upload crafted files that exploit libvips' handling of specialty formats to read arbitrary files, including process environment secrets, potentially escalating to RCE. Default Rails 7.0+ setups using Active Storage with the vips processor are affected before versions 7.2.3.2, 8.0.5.1, and 8.1.3.1; fixes shipped July 29, 2026, with VIPS_BLOCK_UNTRUSTED as a partial mitigation. Proof-of-concept exploits circulated after disclosure, and VulnCheck updated that it observed active exploitation originating from a single French IP establishing C2 to a host in Israel. Akamai deployed WAF rules, but experts stress patching and credential rotation over filtering alone.
82
60
Microsoft Patch Tuesday — February 2019 Update Fixes 77 Flaws
60
Microsoft September 2020 Patch Tuesday addresses 129 flaws
60
60
60
60
Microsoft February 2021 Patch Tuesday fixes 56 bugs, including an actively exploited Windows zero
60
Microsoft patches critical Entra ID vulnerability (CVE-2026-69836)
Microsoft patched critical Entra ID RCE CVE-2026-69836 (CVSS 10.0), fully mitigated server-side with no customer action; no in-the-wild exploitation confirmed.
Microsoft patched CVE-2026-69836, a critical (maximum CVSS 10.0) unauthenticated remote code execution flaw in Entra ID caused by deserialization of untrusted data over a network. Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity service verifying logins and controlling access to Microsoft 365, Azure, and connected third-party apps. The flaw was discovered by Microsoft Principal Security Engineer Robert Fitzpatrick and fully mitigated server-side, requiring no customer action. Microsoft initially reported the bug as exploited, but later changed the status to 'no' and confirmed the vulnerability was not exploited in the wild.
72
Microsoft March 2022 Patch Tuesday updates fix 89 vulnerabilities
60
60
Microsoft Patch Tuesday for January 2021 fixes 83 flaws, including an actively exploited issue
60
Microsoft's March Patch Tuesday fixes 14 Critical flaws
60
Microsoft Issues Patches for Defender Zero
60
Microsoft Releases Windows Security Updates For Critical Flaws
60
60
60
60
Patch Tuesday - September 2026
Microsoft's September 2026 Patch Tuesday fixes 999 CVEs, a record, with two zero-day privilege escalation flaws already exploited in the wild.
Microsoft published 974 own-product vulnerabilities plus 25 non-Microsoft CVEs, totaling 999 — the most CVEs Microsoft has ever released in a single day. Two flaws are exploited in the wild: CVE-2026-85880, an out-of-bounds write in Windows ALPC granting SYSTEM privileges, and CVE-2026-81963, an improper link resolution flaw in the Windows Update Stack also leading to SYSTEM. Chrome's V8 zero-day CVE-2026-85046 was patched in Edge on September 2, but Microsoft had not published a corresponding advisory, leaving uncertainty about other Chromium fixes in Edge. October 14 lifecycle changes end servicing for Windows 11 24H2 Home/Pro, Office 2021, and Exchange Server 2016/2019.
88
Latest Microsoft Updates Patch 4 Critical Flaws In Windows RDP Client
60
60
60
60
Microsoft's March Updates Fix 61 Vulnerabilities, Including Critical Hyper
60
Week in review: 18 free Microsoft Azure cybersecurity resources, K8 vulnerability allows RCE
60
NSA Discovers New Vulnerabilities Affecting Microsoft Exchange Servers
60
Microsoft Patch Tuesday security updates for March 2026 fixed 84 bugs
60
60
60
Microsoft Patch Tuesday for August 2025 — Snort rules and prominent vulnerabilities
60