Today marks a new record for **Microsoft Corp.**, as the tech giant issued updates to address 974 security holes. This massive patch batch far surpasses the previous record set in July, which saw 570 vulnerabilities fixed, bringing this year's total to over 2,600 with three months still remaining.  ### Zero-Days and Critical Flaws Demand Immediate Attention Among the numerous fixes are two critical “zero-day” flaws, **CVE-2026-81963** and **CVE-2026-85880**, both actively being exploited to allow attackers to elevate privileges on **Windows** systems. Of the 974 vulnerabilities, 113 were rated as “critical.” These critical flaws could enable malware or malicious actors to seize control of vulnerable Windows machines with minimal or no user interaction. Notably, **CVE-2026-69730**, a DNS weakness affecting **Windows Server 2012** onward and **Windows 10**, is particularly concerning. Microsoft warns that an unauthenticated attacker could exploit this simply by sending a specially crafted packet, and that exploitation is likely. Another severe critical vulnerability is **CVE-2026-69829**, a remote code execution flaw in the Windows Shell, boasting a CVSS base score of 9.8 and requiring low attack complexity, no privileges, and no user interaction.  ### The AI Paradox: More Vulnerabilities, More Deployment Headaches Microsoft isn't alone in this trend. Companies like **Adobe**, **Cisco**, **Google**, **Mozilla**, and **Oracle** have also reported increased patch volumes, attributing this to AI-assisted vulnerability research. Google, for instance, has announced it will now ship security updates every two weeks. **Tyler Reguly**, associate director of security research and development at **Fortra**, highlights the core challenge for organizations: the necessity of testing updates before widespread deployment. This is crucial to ensure compatibility with third-party software and prevent business disruption. Reguly urges CISOs and CSOs to acknowledge the strain on their teams. “How are you helping your teams through these difficult times?” he asks. “Do you have your teams deploy after hours and on weekends to avoid disruption to the business environment? Do you reward them for that effort?” ### Prioritizing the Patches **Satnam Narang**, senior staff research engineer at **Tenable**, offers a critical perspective. While the number of patches is skyrocketing, he argues that the number of vulnerabilities truly impacting most organizations remains relatively low. “AI-assisted vulnerability discovery in 2026 is creating larger haystacks, but it isn’t finding more needles,” Narang explains. He stresses the importance for organizations to understand which vulnerabilities are applicable, reachable, and exploitable, and to prioritize remediation based on actual risk context. For individual Windows users, pre-deployment testing isn't necessary, but regular updates are essential. Given the growing size of these monthly releases, it's advisable not to let them accumulate. Enterprise Windows administrators are encouraged to monitor resources like **askwoody.com** for any reported issues with updates, and the **SANS Internet Storm Center** provides a detailed, severity-ordered breakdown of each patch.