Patch Tuesday record: Microsoft corrects over 1,400 flaws in one month and attributes this avalanche to LLM

The October volume exceeds the previous September record (nearly 1,000 faults). Microsoft credits large language models for discovering these vulnerabilities; Security teams struggle to follow.

Microsoft released updates on October 13 fixing more than 1,400 vulnerabilities in Windows and its other software, according to KrebsOnSecurity. September's record of nearly 1,000 patches was already about ten times the usual monthly volume. Microsoft attributes this pace to large language models, which accelerate the discovery of vulnerabilities. According to Satnam Narang (Tenable), the year has already passed the 4,000 CVE mark with two months to go, well above the record of 2020 (1,261).

Only one flaw already exploited

Of these patches, at least 78 flaws are considered critical. Only one is a "zero day" that has already been exploited: CVE-2026-96951, a security feature bypass in the Windows 10 and 11 Shell. Another flaw, in the .NET Framework, had been made public before the patch.

These giant batches weigh on security teams, who must test each update before deploying it. Tyler Reguly (Fortra) advises that the 26 Microsoft vulnerabilities listed in CISA's catalog of actively exploited vulnerabilities this year should be addressed as a priority.