Microsoft's September 2026 Patch Tuesday fixes 966 vulnerabilities, its largest release ever, including two zero-days already under active attack: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows ALPC.
Read the full story: Microsoft's Record 966-Flaw Patch Tuesday Hits With 2 Zero-Days →
Transcript
Microsoft just shipped its biggest security update ever. Nine hundred sixty six vulnerabilities patched in one release, more than double what they fixed in July. Two of them are already being exploited right now, both elevation of privilege bugs, one in the Windows Update Stack, one in the ALPC subsystem, and both let an attacker who already has a foothold jump straight to full system access. Microsoft wants these installed within twenty four hours, not the usual patch this week timeline.
But the record number isn't the real story. It's the trend. Two hundred flaws in June. Five seventy in July. Now nine sixty six. Microsoft says an AI system is finding more bugs than ever, which is good for security long term, if patch teams can actually keep up. Update today.