974 fixes in one day. Start with two.

· · Security

Nobody in your business is going to read a list of 974 security fixes. Not your IT person, not your provider, not anyone. That is not a criticism of them, it is arithmetic.

So the useful question is no longer whether you are keeping up. You are not, and neither is anyone else. The question is whether the small number of things that genuinely matter are getting done first, and whether you would be able to tell.

What happened on Tuesday

Microsoft's September update fixed 974 vulnerabilities in a single day, its largest ever by a wide margin. It obliterates the previous record of 570, set in July. As Brian Krebs reported, that takes the year past 2,600, more than twice Microsoft's previous record year of 1,245 in 2020, with three months still to run.

Around 113 were rated critical. The Hacker News counted 723 in Windows itself, 111 in Office, and 62 in SQL, with privilege escalation, remote code execution, and information disclosure making up nearly 90% of the total.

Two are already being used in attacks:

  • CVE-2026-81963, in the Windows Update component, where following a shortcut incorrectly lets someone who already has access to a machine raise themselves to administrator.
  • CVE-2026-85880, a flaw in a Windows messaging component with the same effect: a logged-in user becomes an administrator.

One more is worth knowing about even though nobody has been caught using it yet. CVE-2026-69730 is a weakness in Windows DNS, present from Windows Server 2012 onwards and on Windows 10, which Microsoft says an attacker could trigger by sending a specially crafted packet with no login at all, and which it rates as likely to be exploited.

(Disclosure on those two links: StackFlag is a tool we built, so treat it as an interested recommendation rather than an independent one. It exists because plain-English summaries of individual flaws are genuinely hard to find, and the vendor's own advisory rarely provides one.)

Why the number exploded

Microsoft says AI is speeding up the discovery of vulnerabilities. That explanation is worth taking seriously, because it means this is the new baseline rather than a freak month.

Dustin Childs of the Zero Day Initiative put it more memorably in Computer Weekly's coverage:

"Looking at nearly 1,000 vulnerabilities in a single month, all I can think is: 'My God, it's full of stars.' AI-assisted bug discovery has exploded patch counts into a whole new galaxy, and defenders simply have to embrace the suck."

Here is the asymmetry that matters. Finding flaws has been automated. Testing and deploying the fixes has not. A machine can generate a thousand findings; a person still has to work out whether your accounts system survives the update, and schedule the reboot. The discovery side scaled and the response side did not, and the gap between them is where the risk now lives.

The other thing worth saying plainly: a bigger number is not a more dangerous month. Most of these were found by researchers, reported responsibly, and fixed before anyone used them. Most critical-rated flaws are never exploited at all. Reacting to the headline count is the wrong response, and it is the response the headline invites.

What to actually do

The list is unreadable, so stop treating it as a list. Treat it as three groups.

  • First: anything confirmed as being exploited. That is two flaws this month, not 974. Both were added to CISA's Known Exploited Vulnerabilities catalogue on the same day they were patched. That catalogue is a free public list of flaws confirmed to be under attack, and it is the strongest prioritisation signal available. This group gets done now, out of cycle if necessary.
  • Second: critical flaws on things exposed to the internet. Your firewall, your remote access, your web server, your mail gateway. An attacker has to be able to reach a flaw to use it, so the same severity score means very different things on a public server and on a laptop in your office.
  • Third: everything else, on the normal cycle. Automatic updates, a monthly window, done when it is done. This will be the vast majority, and treating it as urgent is how the first group gets lost.

Two practical additions for a business without a security team:

  • Turn on automatic updates and check they are working. Not the same sentence. The failure mode is not "we decided not to patch", it is "we assumed it was patching and nobody looked". Pick five machines and confirm their last update date. If your provider manages this, ask them for the report.
  • Ask your IT provider one question this month: "Of Microsoft's September updates, which have you applied to our machines, and were the two exploited ones done first?" A good answer names the two and gives a date. A vague answer is itself the finding.

The skill that matters now is not patching faster. It is prioritising honestly, and being able to show your working, which is also what an insurer or a client questionnaire is really asking about.

How Steelwise can help

Working out which of your systems are exposed, what actually needs patching first, and how you would demonstrate that to an insurer or a client is a short, well-defined piece of work. Get in touch if you would like a hand with yours.

Further reading

← All filings

We use cookies to understand how visitors use this site. More information.