Microsoft just patched 979 software flaws. AI attacks are why that number keeps climbing.
September's security update from Microsoft is the largest on record. Researchers say the surge reflects a race against AI tools that can find and weaponise software weaknesses faster than companies can fix them.
Key points
- Microsoft fixed roughly 972 security vulnerabilities (flaws in software that attackers can exploit) in its September 2026 patch release, a new all-time record.
- 112 of those flaws reached the "critical" severity threshold, meaning attackers could use them to take control of a device or steal data with little effort from the victim.
- Just two months earlier, Microsoft's then-record patch had covered 570 vulnerabilities.
- OpenAI, Anthropic, Google, Amazon Web Services and roughly 100 other organisations co-signed an open letter warning that AI tools will soon let attackers find and exploit flaws before companies can fix them.
- Security researcher Dustin Childs at the Zero Day Initiative describes the rising patch counts as "the new normal."
What actually happened this month?
Microsoft's September security update fixed roughly 972 separate vulnerabilities, a new record. That beats the previous record, set just two months ago in July, of 570 fixes. Google has published record patch numbers recently too, which suggests an industry-wide shift.
Of this month's flaws, 112 were rated critical. A critical vulnerability is one an attacker can exploit remotely, often without the victim doing anything beyond having the software installed.
For context: a patch of 100 vulnerabilities used to be considered a heavy month.
Why is the number so high?
AI tools are getting very good at hunting for software flaws, and defenders and attackers alike are using them.
Security teams now use AI to scan their own code, surfacing far more weaknesses than manual review ever could. That's good. But the same capabilities are available to attackers, who can find flaws that companies haven't yet discovered or disclosed.
Two weeks before Microsoft's release, as first reported by Ars Technica, OpenAI, Anthropic, Google, Amazon Web Services and roughly 100 other organisations signed an open letter warning of a "narrowing window" for patching. AI is expected to actively exploit vulnerabilities faster than the industry can push out fixes. One week earlier, we reported that OpenAI's Astra model scored perfectly on a hacking benchmark, a concrete sign the threat isn't theoretical.
Should ordinary users be worried?
Yes, but the action is simple. Install the update.
If you use Windows, go to Settings and open Windows Update to confirm September's patches are applied. Most home users have automatic updates turned on and won't need to do anything.
Dustin Childs, a vulnerability researcher at the Zero Day Initiative (a programme that tracks and discloses security flaws), calls these record counts "the new normal" and warns that the damage from AI-assisted attacks "could eventually be substantial." He isn't predicting immediate catastrophe, but the direction is clear.
What happens next?
Patch counts will almost certainly keep rising. The industry's in a race: find and fix flaws before attackers find and exploit them. AI accelerates both sides.
For home users, the advice is unchanged. Update promptly, enable automatic updates. Businesses running large Windows networks should treat Patch Tuesday as a priority deadline, not a suggestion. Our 8 September story on why Google cut Chrome's update cycle to every two weeks shows the same pressure hitting a different product.
Common questions
Do I need to do anything right now?
If you use Windows, open Settings and check Windows Update to confirm September's patches are installed. Automatic updates handle this for most home users, but it's worth verifying.
Is Microsoft's software less secure than competitors'?
Not necessarily. The high patch count reflects aggressive internal scanning, partly AI-assisted, which surfaces more flaws. Finding and fixing a flaw is safer than leaving it undiscovered.
