Microsoft Patches 1,400+ Flaws, Credits LLMs for the Surge

Microsoft shipped fixes for more than 1,400 security vulnerabilities on Tuesday, a batch that Krebs on Security describes as dwarfing September's record of nearly 1,000 and running about ten times the company's normal monthly load. At least 78 are rated critical, capable of enabling remote code execution with minimal user interaction.

The sole zero-day is CVE-2026-96951, a security feature bypass in the Windows Shell affecting Windows 10, Windows 11, and some Server versions. A second bug, CVE-2026-108398, a .NET Framework security feature bypass, was publicly disclosed before the patch arrived, "potentially giving attackers advance time to work out how to exploit the bug."

Microsoft is openly crediting AI for the volume.

The Krebs write-up puts it bluntly: "Microsoft credits large language models for the high volume of bug discovery, and presumably AI gets credit for many of the patches used to fix these flaw." Year to date, Microsoft has shipped fixes for more than 4,000 CVEs, surpassing the 2020 record of 1,261 with two months of 2026 still to run. "We've now crossed the 4,000 CVE mark with two months left to go," Satnam Narang of Tenable told the outlet.

For defenders, Tyler Reguly of Fortra pointed at prioritization rather than coverage: "Security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act." Only 26 Microsoft CVEs have landed in CISA's Known Exploited Vulnerabilities catalog so far this year, which Krebs flags as the realistic patch-first list.

The disclosure arrives in a dense stretch of AI-and-security reporting on our cybersecurity tracker, which has logged 210 stories over the last 90 days, including today's news that an OpenAI engineer was charged with planting a listening device in a conference room.