Microsoft Patched 400 Bugs This Month and That Is Not the Scary Part

microsoft just patched more than 400 security holes in a single month. again. still up to their old tricks. as secure as ever. one month earlier, they patched 570. until 2026, microsoft had never crossed roughly 200 in a single month.

the numbers are genuinely strange. june hit 200. july shattered every record at 570, the largest patch tuesday ever recorded. august landed around 400. the trailing average is 133. so this month was triple normal, and it was a quiet month by 2026 standards.

here is what changed. microsoft, oracle, adobe, mozilla, and others are increasingly turning ai loose on their own code to hunt for flaws hiding in plain sight. it is working at a scale human review never reached. mozilla says one anthropic model found 271 firefox security bugs.

so the obvious story writes itself. ai finds infinite bugs. attackers exploit infinite bugs. then the entire planet drowns.

except that is not what the data shows, and the real story is more interesting than the panic.

despite the flood of new vulnerabilities, real-world exploitation has not surged at the same rate. the supply of newly discovered flaws is growing much faster than the number attackers are actually weaponizing. so far, that gap is the only breathing room defenders have.

do not exhale though, because the reason is not comforting.

anthropic tested 14 microsoft vulnerabilities rated "exploitation less likely" or "exploitation unlikely." its model produced working proofs of concept for 13 of them.

that is the number that matters.

not 400.

not 570.

13 of 14.

the capability barrier is clearly falling. the bottleneck is no longer whether ai can help turn a disclosed vulnerability into a working exploit. it can. the bottleneck is whether attackers have operationalized that capability at scale.

microsoft has already reacted. its 2026 patching guidance now pushes quality-update deferrals below three days, deployment deadlines to zero or one day, and grace periods to one or two days. the time between disclosure, patch analysis, and usable exploit development is compressing fast.

and we already have the live reminder. CVE-2026-68820 was exploited as a zero-day, with check point tying the activity to lazarus and a new fudmodule rootkit variant.

the real picture is not a tsunami of attacks. it is a tsunami of newly visible flaws, defenders being asked to patch three or four times the normal volume, and adversaries whose exploit-generation capability is catching up fast.

the dangerous number is not 400 patches.

it is 13 of 14.

the vulnerability flood is already here.

the exploitation flood is not.

yet.