Microsoft's October Patch Tuesday is the biggest one yet.
The company fixed 1,411 vulnerabilities this month, including three zero-days (flaws that were already being exploited or publicly known before a patch existed). One, a security-feature-bypass bug in Windows Shell tracked as CVE-2026-96951, was actively exploited in the wild. The other two, affecting .NET and MessagePack-CSharp, were publicly disclosed but not yet attacked. Of the total, 70 bugs are rated critical, and the fixes span elevation-of-privilege and remote-code-execution flaws to information disclosure and denial-of-service issues.
The bigger story is the trend line, not the single update. Patch counts have climbed every month since June, and Microsoft points to AI as the reason: the same models that help attackers build exploit tools faster are also helping defenders find and fix bugs faster, meaning bigger batches of patches on a shorter clock. That's a genuinely new dynamic for IT teams who used to treat Patch Tuesday as a predictable, double-digit chore.
A year ago, October's update covered fewer than 180 flaws, six of them zero-days. This month's total is nearly eight times that, with half as many zero-days, which says less about Windows getting buggier overnight and more about both sides of the security fight learning to move faster.