{"schema":"postcutoff/event@1","as_of":"2026-10-14T17:23:00+02:00","url":"https://postcutoff.com/e/2026-10-13-microsoft-october-patch-tuesday-record-1400-flaws/","md":"https://postcutoff.com/e/2026-10-13-microsoft-october-patch-tuesday-record-1400-flaws/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"human editor","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-10-13-microsoft-october-patch-tuesday-record-1400-flaws","date":"2026-10-13","date_precision":"day","short_title":"Microsoft's October Patch Tuesday fixes a record ~1,400 flaws, more than all of 2025, as AI-driven bug discovery floods vendors","deck":null,"takeaway":"Microsoft's October 13, 2026 Patch Tuesday fixed more than 1,400 vulnerabilities (1,411 per BleepingComputer, 1,413 per SecurityWeek), beating September's record of nearly 1,000.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":[{"n":1,"title":"MSRC (April 2026): Strengthening secure software at global scale: how MSRC is evolving with AI","url":"https://www.microsoft.com/en-us/msrc/blog/2026/04/strengthening-secure-software-global-scale-how-msrc-is-evolving-with-ai","type":"official","group":"primary","domain":"microsoft.com"},{"n":2,"title":"Krebs on Security: Microsoft patches more than 1,400 security flaws","url":"https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws/","type":"press","group":"press","domain":"krebsonsecurity.com"},{"n":3,"title":"SecurityWeek: Microsoft patches record 1,413 vulnerabilities including exploited Windows zero-day","url":"https://www.securityweek.com/microsoft-patches-record-1413-vulnerabilities-including-exploited-windows-zero-day/","type":"press","group":"press","domain":"securityweek.com"},{"n":4,"title":"BleepingComputer: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days","url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/","type":"press","group":"press","domain":"bleepingcomputer.com"}],"official":1,"filed":"2026-10-14","updated":"2026-10-14","orgs":["Microsoft"],"title":"Microsoft's October Patch Tuesday fixes a record ~1,400 flaws, more than all of 2025, as AI-driven bug discovery floods vendors","summary":"Microsoft's October 13, 2026 Patch Tuesday fixed more than 1,400 vulnerabilities (1,411 per BleepingComputer, 1,413 per SecurityWeek), beating September's record of nearly 1,000. SecurityWeek says Microsoft patched more flaws this month than in all of 2025. Krebs reports that Microsoft credits large language models for the volume of bugs found. One Windows Shell zero-day (CVE-2026-96951) is exploited in the wild.","key_facts":["Counts: 1,411 (BleepingComputer) / 1,413 (SecurityWeek) / 'more than 1,400' (Krebs). SecurityWeek breakdown: 1,102 Windows, 134 Office, 61 developer tools, 36 SharePoint Server. BleepingComputer: 70 rated Critical (57 RCE)","Previous record: September 2026, nearly 1,000 fixes (Krebs). SecurityWeek: 'This month alone, Microsoft patched more vulnerabilities than it did in all of 2025'; 2026 has passed 4,000 fixed flaws. Tenable's Satnam Narang compares this with 2020's full-year 1,261 CVEs (via Krebs)","AI attribution: Krebs says 'Microsoft credits large language models for the high volume of bug discovery'; BleepingComputer: 'Microsoft continues to use artificial intelligence platforms to find and remediate security vulnerabilities in its products'. Neither names specific models or programmes (e.g. Project Glasswing), and we did not find Microsoft's own wording","Exploited zero-day: CVE-2026-96951 (CVSS 8.8), a Windows Shell security-feature bypass that evades Mark of the Web; SecurityWeek says it was reported by researchers at Fujitsu, Anthropic and an independent expert. CISA added it to KEV with an Oct 16 deadline for federal agencies","Two more publicly disclosed zero-days: CVE-2026-108398 (.NET Framework WDAC bypass, found by James Forshaw of Google Project Zero) and CVE-2026-92707 (MessagePack-CSharp denial of service)","Background: in April 2026 MSRC wrote that recent models paired with security tooling find vulnerabilities 'at a level approaching experienced human security researchers' and that it was changing its processes accordingly"],"key_numbers":[],"tags":["cybersecurity","vulnerabilities","patch-tuesday","ai-bug-finding","microsoft","zero-day"],"science":null,"body_md":"## What happened\n\nMicrosoft's monthly security update for October 2026 was the largest on record, at roughly 1,400 CVEs, after September's update had already\nset a record of nearly 1,000. Security press attribute the surge to AI-assisted vulnerability discovery, and Krebs reports that Microsoft\nitself credits LLMs. Outlets give slightly different totals depending on how they count third-party and non-Windows CVEs.\n\n## Why it matters\n\nIt is a concrete measure of the \"vulnerability flood\" that defenders have warned about since models such as Claude Mythos and GPT-6 Astra\ncrossed into expert-level bug finding: one vendor fixed more flaws in a month than in all of the previous year. Every one of these\npatches also tells attackers where the bugs were (Alex Stamos's \"Patch Tuesday, Ransom Wednesday\" warning).","disputed":[],"related":[{"id":"2026-10-06-anthropic-cyber-verification-program-three-tiers","url":"https://postcutoff.com/e/2026-10-06-anthropic-cyber-verification-program-three-tiers/","date":"2026-10-06","date_precision":"day","short_title":"Anthropic folds Project Glasswing into a three-tier Cyber Verification Program","deck":"Reports 129K+ vulnerabilities found by partners","takeaway":"It said Glasswing partners found 129,000 verified vulnerabilities in April–July 2026 and its own open-source scanning another 5,500 through October, more than 33,000 of them critical or high severity.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":7,"official":2,"filed":"2026-10-07","updated":"2026-10-10","orgs":["Anthropic"]},{"id":"2026-09-29-stamos-cognition-cso","url":"https://postcutoff.com/e/2026-09-29-stamos-cognition-cso/","date":"2026-09-29","date_precision":"day","short_title":"Alex Stamos joins Cognition as CISO, warning that AI models make 'Patch Tuesday lead to Ransom Wednesday'","deck":null,"takeaway":"A prominent security figure is moving to an agent company during a wave of agent security incidents.","category":"business","category_label":"Business","importance":2,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":3,"official":2,"filed":"2026-09-30","updated":"2026-09-30","orgs":["Cognition"]}],"people":[],"posts":[],"videos":[],"models":[],"changes":[{"date":"2026-10-14","type":"filed","text":"Created (Krebs, SecurityWeek, BleepingComputer read; Microsoft's own statement not located)"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-10-14","run":null,"sources_read":"Krebs, SecurityWeek, BleepingComputer read; Microsoft's own statement not located","updated":"2026-10-14","human_review":null,"version":{"date":"2026-10-14"}},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":166,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":105,"in_training_data":false},{"model_id":"gemini-4-argon","name":"Gemini 4 Argon","cutoff":"2026-03","days_after":196,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":135,"in_training_data":false}],"short_url":null}