Microsoft Plugs 398 Security Holes in Windows Systems
Critical security updates released for Windows operating systems.
1Record Number of Security Vulnerabilities
Microsoft released updates addressing 398 security flaws in Windows OS and supported software. While lower than last month's record of 570 patches, it doubles June's then-record of 200 fixes. 42 vulnerabilities were rated 'critical', allowing attackers to potentially gain system control without user interaction.
2Actively Exploited Zero-Day Flaw
The only known zero-day patched this month is CVE-2026-68820, a privilege escalation vulnerability in the afd.sys Windows socket driver. Automox explains attackers can use this as step two in an attack chain after initial phishing. Despite its 7.0 complexity score (due to race conditions), attackers are successfully exploiting it in the wild.
3Other Critical Vulnerabilities
CVE-2026-62832 is another privilege escalation flaw in Windows User Profile Service, possibly related to the 'LegacyHive' disclosure. CVE-2026-72971 is a low-impact local tampering vulnerability deemed unlikely to be exploited. Microsoft attributes the surge in discoveries to AI-assisted vulnerability detection methods.
4Industry-Wide Patch Surge
Adobe moved to twice-monthly security bulletins, while Cisco, Google, Mozilla and Oracle are also releasing updates more frequently. AI is dramatically increasing vulnerability discoveries across the software industry. However, experts emphasize human oversight remains crucial in the patching process.
5The AI Patching Challenge
1Password researchers tested LLM-generated patches for complex vulnerabilities. Over half either failed to fix the flaw or introduced new weaknesses. SANS Technology Institute's Ed Skoudis noted: 'AI is becoming astonishingly good at finding vulnerabilities, but fixing them requires human testing and iterative improvement.'
6Recommendations for Security Teams
Fortra's Tyler Reguly advises security leaders to assess how teams are handling increased patch workloads. 'There's no need to rush these updates,' he says, emphasizing thorough testing before production deployment. Only one of the 398 flaws is currently known to be actively exploited, allowing time for proper validation.
7User Recommendations
Experts recommend backing up systems before applying massive patch bundles like this. The day after Patch Tuesday (sometimes called 'Reboot Wednesday') occasionally sees problematic updates. Waiting a few days allows Microsoft time to address any faulty patches that might emerge post-release.
8The New Era of Cybersecurity
AI-powered vulnerability discovery has ushered in a new cybersecurity era. However, human expertise remains essential for effective patching. The industry faces an asymmetric battle as AI enhances both defensive and offensive capabilities. Microsoft's record patch release exemplifies this ongoing technological arms race.
Original article: Krebs on Security — Microsoft 398 Güvenlik Açığını Kapattı