Microsoft’s September patch Tuesday wasn’t just another routine maintenance window. It was a deluge. The tech giant addressed roughly 972 vulnerabilities, with 112 classified as critical severity. This isn’t a slight uptick. It is a massive leap from the 570 flaws fixed just two months ago and the 620 patched last month. If you think your IT team was busy before, brace yourself. The volume of code requiring urgent attention has nearly doubled in a single quarter.
This surge isn’t happening in a vacuum. Google and other major players are reporting similar spikes. Two weeks ago, a coalition including OpenAI, Anthropic, Amazon Web Services, and Microsoft signed an open letter warning that the window to patch vulnerabilities is narrowing. They anticipate a tsunami of AI-enabled attacks that will exploit these weaknesses faster than humans can fix them. The industry is effectively racing against its own automation. We are pumping out patches at unprecedented rates because the tools to find bugs are getting smarter, too.
Dustin Childs, a researcher at the Zero Day Initiative, calls this spike the “new normal.” He offers a backhanded compliment to Microsoft’s security teams for managing this workload but warns that AI-assisted vulnerability discovery shows no signs of slowing down. Crucially, Childs notes that we haven’t seen a correlating spike in active exploits yet. That silence is likely temporary. The damage from AI-assisted attacks could eventually be substantial, even if the current exploit rate hasn’t caught up to the discovery rate.
Counting these bugs is imperfect science. Some fixes address non-Microsoft products or previously known issues. By Childs’s count, the total hits 997 when including Chromium browser fixes ported to Edge. Already this year, Microsoft has fixed 2,760 vulnerabilities. That is more than double last year’s total. At this pace, Microsoft will fix more bugs this year than in 2023, 2024, and 2025 combined. The question isn’t whether they can keep patching. It’s whether defenders can stay ahead of attackers who now have AI doing their homework.
