This month's extensive patch bundle from **Microsoft**, while not surpassing July's record of over 570 security updates, significantly outpaced June's nearly 200 fixes. The company attributes this growing volume of vulnerability discoveries to the aid of artificial intelligence, suggesting that IT security professionals should anticipate larger Patch Tuesday releases as the new norm. Out of the 398 flaws addressed, 42 received **Redmond's** most severe 'critical' rating. These vulnerabilities are serious enough to allow malware or malicious actors to gain remote control over a **Windows** computer with minimal user interaction. ### Actively Exploited Zero-Day and Public Disclosures The sole known zero-day bug patched this month is **CVE-2026-68820**, a privilege escalation weakness residing in **afd.sys**, a core **Windows** component. **Automox** describes **afd.sys** as "the driver behind Windows socket connections on effectively every endpoint." **Landon Miles** of **Automox** explained in a Patch Tuesday blog post, "This isn’t a front-door bug. It’s step two in a chain: an attacker phishes their way into a low-privilege foothold, then uses the driver flaw to take the box. The 7.0 score reflects the high attack complexity, because race conditions are fiddly. The exploit has to be thrown over and over until the timing lands. Someone is clearly landing it anyway." Another privilege escalation flaw, **CVE-2026-62832**, in the Windows User Profile Service, has been flagged by **Microsoft** as likely to be exploited. This vulnerability may be linked to the recent "LegacyHive" public disclosure by the prolific bug hunter **Nightmare Eclipse**. The other publicly disclosed flaw is **CVE-2026-72971**, a low-impact local tampering vulnerability deemed unlikely to be exploited. ### The Double-Edged Sword of AI in Cybersecurity **Microsoft** is not alone in experiencing an increase in patch volumes due to AI-assisted discoveries. Companies like **Adobe**, **Cisco**, **Google**, **Mozilla**, and **Oracle** are also releasing updates more frequently and abundantly. While AI demonstrates remarkable efficacy in identifying software vulnerabilities, the process of patching these "bugpocalypses" largely remains a human-centric endeavor. A crucial question arises: can AI technologies be as effective at fixing vulnerabilities as they are at finding and exploiting them? Researchers at **1Password** recently investigated how different large language models (LLMs) perform when generating patches for complex, newly disclosed vulnerabilities. Their findings indicated that LLMs frequently produced patches that either failed to resolve the flaw, introduced new weaknesses, or both, in over half of the cases. **Ed Skoudis**, President of the **SANS Technology Institute**, noted that his team has observed excellent results using AI for patch generation, provided there is human oversight for testing and iterative improvements. "AI is rapidly becoming astonishingly good at finding vulnerabilities, but this research shows that fixing them is a very different problem," Skoudis stated in a **SANS** newsletter. "Don’t expect one-shot AI patching to work reliably. Instead, iterate, test, challenge, improve, and verify. AI can be an extraordinary patching partner, but today it still needs a skilled human at the keyboard." ### Strategic Patching in a High-Volume Landscape **Tyler Reguly** at **Fortra** advises organizations not to rush the deployment of these extensive updates, despite the sheer number of vulnerabilities. He emphasizes that only one of the almost 400 bugs addressed this month is actively exploited. Reguly encourages security leaders to engage with their teams to understand how they are adapting their workflows to manage the increased patching demands, which often involve rigorous testing before production deployment. "If you’re a chief security officer talk to your teams about how they are shifting or modifying their workflows to better accommodate the patching shift that we’re seeing and support them across various organizational units by enabling the changes they want to see made," Reguly recommended. "There’s no need to rush these updates, no matter what various vendors and organizations try to tell you. You need to make sure that you are rolling out safe updates that will not negatively impact your systems." As a best practice, always back up your systems and data before applying large update bundles. While the day after Patch Tuesday is sometimes jokingly called "Reboot Wednesday," waiting a few days to deploy extensive updates can allow **Microsoft** to address any unforeseen issues that might arise from a misbehaving patch. For a detailed, clickable breakdown of this month's patches by severity and urgency, refer to the **SANS Internet Storm Center's** roundup.