Why this month’s Microsoft patch launch is a doozy

Microsoft’s patch for September is a doozy, with a file variety of roughly 972 vulnerabilities fastened and 112 of them assembly the excessive critical-severity threshold.

It was solely two months in the past that Microsoft patched a then-record 570 vulnerabilities. Then, final month, Microsoft patched some 620 of them. Google and different firms have additionally revealed file numbers of vulnerabilities in latest months. Two weeks in the past, OpenAI, Anthropic, Amazon Net Companies, Google, Microsoft, and 100 firms and organizations revealed an open letter warning of a narrowing window for patching vulnerabilities forward of an anticipated tsunami of AI-enabled assaults that actively exploit them first. The trade is taking the risk critically by pumping out unprecedented numbers of patches of their software program.

Welcome to the brand new regular

Dustin Childs, a researcher on the Zero Day Initiative, calls the spikes the “new regular” and in addition cautions that regardless of them, the harm that’s prone to end result from AI-assisted assaults may ultimately be substantial.

“On the one hand, congrats to the safety gnomes at Microsoft for with the ability to patch bugs at this fee,” Childs wrote Tuesday. “Alternatively, AI-assisted vulnerability discovery exhibits no indicators of slowing down. Nevertheless, we have now not seen a correlating spike in energetic exploits—but.”

Counting the exact variety of vulnerabilities fastened in a month-to-month patch launch for Microsoft is rarely an actual science. In some circumstances, the bugs have been beforehand addressed or affected non-Microsoft merchandise. By Childs’s rely, Tuesday’s launch patches 972 vulnerabilities, and 997 when counting the porting of fixes for the Chromium browser included into Edge. Of the brand new vulnerabilities, 112 of them are rated crucial, with the rest carrying the vital designation. Already this 12 months, Microsoft has fastened 2,760 vulnerabilities, greater than double the quantity from final 12 months. At this fee, Microsoft will full the 12 months having fastened extra bugs than all of 2023, 2024, and 2025 mixed.