Microsoft patches a record 570 security flaws, and says AI found them

Key points

• Microsoft patched 570 security vulnerabilities on 15 July 2026, the most it has ever released in a single monthly update.
• At least two of those flaws were zero-days, meaning attackers were already exploiting them before Microsoft knew they existed.
• One zero-day lets an attacker on a Windows Server machine quietly promote themselves from a regular user to a full administrator.
• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that a second zero-day, in Microsoft's SharePoint file-sharing software, was being actively used to break into organisations.
• Microsoft says AI tools helped its staff find more hidden bugs, and promises patch numbers will stay high as a result.

Every second Tuesday of the month, Microsoft releases a bundle of software fixes for Windows and Office, among other products. Security researchers call it "Patch Tuesday." This week's bundle broke every record before it.

Microsoft issued patches for 570 separate security flaws on Tuesday, 15 July 2026. That's a different order of magnitude from any previous release.

The company had warned this was coming. A week earlier, in a public blog post, Microsoft's Windows chief Pavan Davuluri said monthly patch counts would climb. The reason: Microsoft's engineers are now using AI to hunt for bugs buried inside its code.

"As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release," Davuluri wrote.

Some of Microsoft's Windows code is decades old. AI tools can scan it far faster than a human reviewer and catch patterns that human eyes miss. The result is a backlog of hidden vulnerabilities finally surfacing all at once. Our 14 July story on researchers turning AI hacking tools against attackers shows the same dynamic running in the opposite direction: defenders and attackers are both leaning on AI now, and the pace of discovery on both sides is accelerating.

Should ordinary users be worried?

For most people running Windows with automatic updates switched on, the answer is no, provided you let the update install. Delaying is where the real danger sits.

Two flaws demand attention. Both are zero-days: criminal hackers found and exploited them before Microsoft had a fix ready.

The first targets Windows Server, the version businesses use to run internal networks. It lets an attacker who already has limited access quietly grant themselves full administrator control, letting them read files and move through a company's network unchecked.

The second zero-day sits in SharePoint, Microsoft's tool for sharing and storing files inside organisations. CISA confirmed attackers are using this flaw right now to compromise real organisations. Krebs on Security first reported the full scope of the patch release.

If your workplace uses SharePoint, tell your IT team today that the July Patch Tuesday update is urgent.

Should IT teams watch for anything specific?

Yes. Look for unexpected new user accounts with administrator-level access, SharePoint files accessed or modified at unusual hours, and any alert flagging privilege escalation (a user account suddenly gaining more permissions than it should have). These are the clearest early signs that one of this week's zero-days has already been used against you.