Microsoft’s September patch is a doozy, fixing roughly 972 vulnerabilities, including 112 that meet the high‑severity threshold. The surge mirrors a broader industry pattern, as competitors such as Google have reported high numbers of fixes in their recent releases.
The figure tops the 570 bugs Microsoft addressed two months earlier and the 620 patched last month. Other firms, such as Google, have also reported record‑high numbers in recent releases.
Two weeks ago an open letter signed by OpenAI, Anthropic, Amazon Web Services, Google, Microsoft and about 100 other groups warned that AI‑enabled attacks could exploit unpatched flaws faster than defenders can respond. The letter warned that AI tools can locate and weaponize flaws faster than traditional methods, compressing the defensive window. The industry’s reaction has been to push out an unprecedented volume of updates.
Dustin Childs, a researcher at the Zero Day Initiative, called the surge the “new normal.” He wrote, “On the one hand, congrats to the security gnomes at Microsoft for being able to patch bugs at this rate. On the other hand, AI‑assisted vulnerability discovery shows no signs of slowing down. However, we have not seen a correlating spike in active exploits—yet.”
Read Also: The web behind a $3.2B AI data center
For everyday users, the rapid pace means more frequent reboot prompts and a higher chance that a device will need a restart at an inconvenient moment. Such timing can interrupt activities like video calls or file transfers, making update scheduling a more pressing consideration for many. It also signals that keeping systems up to date will become a regular habit rather than an occasional task. The sheer number of fixes suggests that many hidden flaws are being discovered, which could reduce the window for attackers who rely on known weaknesses.
Patch cadence accelerates.
Counting exact totals is tricky; some bugs were previously addressed or affect non‑Microsoft products. By Childs’s tally, the release patches roughly the same number of issues, rising to 997 when the Chromium fixes ported into Edge are included. All newly disclosed flaws are marked “important” except those classified as critical.
Enterprises often schedule updates during maintenance windows to avoid disruption.