[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-microsoft-patches-record-570-windows-flaws-two-exploited-now":10,"sections":40},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":35,"feedback":39,"feedback_at":22,"cost_usd":39,"total_tokens":39},4705,"microsoft-patches-record-570-windows-flaws-two-exploited-now","Microsoft Patches Record 570 Windows Flaws, Two Exploited Now","July Patch Tuesday triples the previous record and includes two actively exploited privilege-escalation zero-days and a publicly disclosed BitLocker bypass.","Microsoft's July Patch Tuesday is the largest security update the company has ever shipped, patching 570 vulnerabilities across Windows and related products.\n\nThe previous record was set just last month, when June's update covered roughly 200 flaws — July's release triples that figure. Of the 570 bugs, 59 are rated critical, spanning remote-code-execution, elevation-of-privilege, security-bypass, and spoofing categories. Three zero-days are included. Two have been actively exploited in the wild: CVE-2026-56155, an elevation-of-privilege flaw in Active Directory Federation Services discovered by Microsoft's own DART team, and CVE-2026-56164, a missing-authentication bug in SharePoint Server that lets an unauthenticated attacker gain elevated privileges over a network — credited to researchers at Mandiant Incident Response and Google Cloud FLARE, among others. The third, CVE-2026-50661, is a different class of problem: a security feature bypass in BitLocker that could expose encrypted data to someone with physical machine access. It was publicly disclosed before the patch but has no known active exploits.\n\nThe sheer volume matters less than the mix. Two actively exploited privilege-escalation flaws in enterprise staples — Active Directory and SharePoint — mean corporate IT teams are the ones with the most to lose if patching lags. The BitLocker bypass is worth watching separately: physical-access requirements limit its blast radius, but it is precisely the kind of flaw that surfaces in targeted attacks against high-value individuals.\n\nFor context, the previous single-month record stood for about four weeks. Whether Microsoft is shipping more bugs or just finding them faster is the question its security team probably doesn't want asked out loud.","[\"security\",\"windows\",\"microsoft\",\"patch-tuesday\"]","2026-07-14T19:52:57.000Z","2026-07-14T20:56:38.367Z","2026-07-14T20:56:41.171Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"The dek states 'two zero-days already being actively exploited' but the body's own breakdown of CVE-2026-50661 describes it as a BitLocker *security bypass*, not a third zero-day that is actively exploited — which is accurate — yet the dek implies all urgency stems from two exploited zero-days while glossing over the fact that the source explicitly calls CVE-2026-50661 a 'security feature bypass' not a privilege-escalation flaw; more critically, the body mischaracterizes CVE-2026-50661 as a 'Bit","resolved","security",[30,32,33,34],"windows","microsoft","patch-tuesday",[36],{"name":37,"url":38},"Lifehacker","https:\u002F\u002Flifehacker.com\u002Ftech\u002Fmicrosoft-just-patched-570-flaws-in-windows?utm_medium=RSS",0,{"sections":41},[42,47,51,56,61,66,71,76,81,86,91,95,100,105],{"name":43,"slug":44,"count":45,"latest_published_at":46},"AI","ai",2583,"2026-07-15T21:33:20.000Z",{"name":48,"slug":30,"count":49,"latest_published_at":50},"Security",294,"2026-07-15T19:59:48.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Policy","policy",158,"2026-07-16T00:02:48.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Hardware","hardware",122,"2026-07-14T19:46:26.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Consumer Tech","consumer-tech",93,"2026-07-13T13:20:48.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Software","software",70,"2026-07-13T19:52:25.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Science","science",66,"2026-07-10T10:29:37.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Dev Tools","dev-tools",59,"2026-07-07T04:00:00.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":92,"slug":93,"count":89,"latest_published_at":94},"Startups","startups","2026-06-29T20:55:50.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"General","general",29,"2026-07-10T22:28:58.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":106,"slug":107,"count":108,"latest_published_at":109},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]