Microsoft Sets New Patch Tuesday Record with Latest Updates

Microsoft engineers are usually able to enjoy a quieter summer for vacations and family time, but this year has been exceptionally busy for Windows and security engineers due to new AI models uncovering software vulnerabilities at a rapid rate. Sources have indicated that Microsoft is set to achieve another record for Patch Tuesday today, marking the third such record in just a few months.

The surge in activity began in April when Anthropic’s new Mythos model identified security vulnerabilities in “every major operating system and web browser.” Shortly after, OpenAI introduced its own cybersecurity-focused model to trusted partners. According to sources familiar with Microsoft’s security operations, both of these models have significantly contributed to a series of record-breaking Patch Tuesdays over the summer.

While Microsoft typically addresses around 100 flaws each month, June saw a new record of approximately 200 fixes. July’s Patch Tuesday was even more substantial, with Microsoft addressing at least 570 security vulnerabilities, nearly triple the number from the previous month. In August, Microsoft engineers had a chance to catch their breath as they resolved nearly 400 security issues.

Today’s Patch Tuesday in September is anticipated to set a new record, with over 650 security fixes for Windows alone. This number is six times higher than the usual amount that was patched before the arrival of the AI models. Engineers have been diligently verifying fixes for numerous critical patches, including remote code vulnerabilities, privilege escalations, and more.

As Microsoft increasingly relies on security-focused AI models to identify software vulnerabilities, the volume of flaws requiring patching continues to rise. While today’s Patch Tuesday marks another record-breaking event, it is likely that this record will be surpassed again, especially if there are further advancements in AI models soon.

Similar to other software companies, Microsoft is actively searching for vulnerabilities to prevent malicious actors from exploiting undiscovered weaknesses in Windows, Azure, and other software. While Microsoft is issuing an unprecedented number of fixes, the sheer volume is also placing pressure on businesses reliant on Microsoft’s software to apply the patches promptly.

IT administrators typically need to test Microsoft patches to ensure that the fixes do not interfere with critical business applications, creating a “patch gap” between a vulnerability being disclosed and the fix being implemented. In an era where security vulnerabilities are rapidly uncovered and disclosed due to AI advancements, businesses are under immense pressure to close this patch gap promptly.

Earlier this year, Anthropic discovered that Mythos could generate working exploits for newly disclosed software vulnerabilities within hours, posing a risk to businesses if patches are not applied promptly. This risk is particularly heightened if Microsoft identifies remote code vulnerabilities that are easy for hackers to exploit.

The concept of the patch gap has always been a concern in cybersecurity, but with the increasing number of vulnerabilities discovered in the AI era, it is likely that Microsoft and other companies will emphasize the importance of promptly applying patches once again. With hundreds of vulnerabilities being identified monthly, time becomes a critical factor in ensuring system security.

In other news, Microsoft is reportedly delaying the release of Forza Horizon 6 on the PS5, with sources indicating that the game will now launch in early 2027. The decision to postpone the release is said to align with the launch of the first expansion for Forza Horizon 6. The popular game series has seen success on Xbox and PC, with Forza Horizon 5 being well-received on the PS5 after its release last year.

In conclusion, the cybersecurity landscape is evolving rapidly, driven by the discovery of vulnerabilities through advanced AI models. Microsoft’s response to these vulnerabilities underscores the critical importance of promptly addressing security issues to mitigate risks and protect systems from potential exploitation.