Microsoft’s September Patch: Why It Matters for Security
▼ Summary
– Microsoft has fixed a record-breaking 972 vulnerabilities in its September patch, with 112 rated as critical severity.
– This surge in patches follows recent records from Microsoft and other tech giants amid warnings of AI-enabled cyberattacks.
– Industry experts describe these high vulnerability counts as the new normal due to AI-assisted discovery tools slowing down.
– Microsoft has already fixed more bugs this year than in all previous years combined, potentially exceeding the total for 2023 through 2025.
– Despite the volume of fixes, researchers note that active exploits have not yet spiked proportionally to the number of discovered vulnerabilities.
Microsoft has released its September security updates, marking a significant escalation in the volume of code corrections required to maintain digital safety. The latest release addresses approximately 972 vulnerabilities, with 112 classified as critical severity. This surge follows a pattern of increasing patch volumes, coming just two months after Microsoft addressed 570 issues and last month when it fixed roughly 620 bugs.
The broader technology sector is experiencing similar trends. Major players including Google, OpenAI, Anthropic, and Amazon Web Services recently joined forces to publish an open letter warning about the shrinking window for applying patches. They highlighted the imminent threat of an AI-driven wave of attacks that will actively exploit software flaws before defenders can respond. In response, companies are releasing unprecedented numbers of updates to counter these emerging threats.
The “New Normal” of Vulnerability Discovery
Security experts are adapting to this heightened pace of discovery. Dustin Childs, a researcher at the Zero Day Initiative, describes these spikes in vulnerability reports as the “new normal.” While he acknowledges the effort required to manage these updates, he warns that the long-term impact of AI-assisted attacks could be severe.
Childs provided context on the current state of affairs in a statement published Tuesday: “On the one hand, congrats to the security gnomes at Microsoft for being able to patch bugs at this rate,” Childs wrote Tuesday. “On the other hand, AI-assisted vulnerability discovery shows no signs of slowing down. However, we have not seen a correlating spike in active exploits,yet.”
Tracking the Scale of Fixes
Determining the exact count of fixed vulnerabilities in any monthly release is complex. Some reported bugs may have been previously resolved or may affect third-party products rather than Microsoft’s own software. According to Childs’ analysis, the recent update fixes 972 distinct vulnerabilities. When accounting for the porting of fixes for the Chromium browser integrated into Microsoft Edge, that number rises to 997.
Of the newly identified issues, 112 are rated critical, while the rest carry an important designation. This year alone, Microsoft has patched 2,760 vulnerabilities. This figure is more than double the total from last year. If this trajectory continues, Microsoft will fix more bugs by the end of this year than were recorded in the combined totals of 2023, 2024, and 2025.
(Source: Ars Technica)
