# Microsoft Just Fixed 1,400 Security Holes in One Month. Now What? > Microsoft fixed about 1,400 flaws in October, a record driven by AI bug hunting. What it means for small business patching and what to do first. - Canonical: https://www.rnits.com/blog/microsoft-patch-tuesday-1400-fixes-ai-small-business - Provider: RNITS — cybersecurity-first managed IT for small businesses - Phone: (978) 226-8931 - Talk to RNITS: https://www.rnits.com/contact · Free cyber security audit: https://www.rnits.com/free-cyber-security-audit - Published: 2026-10-17 - Category: Cybersecurity - Tags: Patch Management, Microsoft, Windows, AI Threats For most of the last decade, Microsoft's monthly security update fixed somewhere around 100 problems. IT people grumbled about it, tested it, and pushed it out. It was routine. On October 13, Microsoft fixed roughly 1,400. No typo there, and October wasn't a fluke. July's release set a record at about 570. September broke it with close to 1,000. October beat that by another 400 or so. Tenable's Satnam Narang pointed out that this single month beat the entire year of 2020, when Microsoft fixed 1,261 vulnerabilities across all twelve releases. With two months still to go, 2026 has passed 4,000. Microsoft has been clear about why: artificial intelligence is finding bugs faster than people ever could. That's good news in the long run. In the short run it changes what "keeping your computers updated" means for a small business, and most small businesses haven't caught up. ## What actually shipped on October 13 The second Tuesday of every month is Patch Tuesday, when Microsoft releases its security fixes for Windows, Office, Exchange, SharePoint, SQL Server and the rest of its products. Here's what October's looked like, based on the trackers that count these things: - **The total.** Between 1,407 and 1,416 fixes, depending on who's counting. CrowdStrike counted 1,413, Tenable 1,407, BleepingComputer 1,411. The numbers differ because researchers include different products and previously released fixes. Call it 1,400. - **Where they landed.** Windows itself took about 1,100 of them. Office had over 130. SharePoint, SQL Server, Exchange and developer tools made up most of the rest. - **How bad.** Somewhere between 70 and 85 are rated Critical, depending on the tracker, and most of those allow an attacker to run their own code on the machine. By type, CrowdStrike counted 677 privilege escalation bugs (an attacker who's already in gets admin rights) and 317 remote code execution bugs (an attacker runs code without already being in). - **The one under attack.** One flaw, CVE-2026-96951, was already being used by attackers before the fix existed. It's a hole in Windows Shell that lets a malicious download skip the "this file came from the internet" warning, the one that triggers SmartScreen and opens Office documents in Protected View. CISA added it to its list of known exploited vulnerabilities and gave federal agencies until October 16 to fix it. That's three days. - **The one with a head start.** A second flaw, CVE-2026-108398 in the .NET Framework, was publicly disclosed before the patch came out. Nobody has been seen exploiting it yet, but anyone who wanted to had the details early. ## Why the numbers exploded: AI is doing the bug hunting In July, Microsoft's Windows chief Pavan Davuluri warned customers directly: "customers will see a higher volume of security updates included in each security release." The engine behind a lot of this is a system Microsoft calls MDASH, short for Multi-Model Agentic Scanning Harness. Microsoft's own descriptions say it runs more than 100 AI agents that read code, argue with each other about whether a bug can actually be exploited, and then try to prove it by building a working exploit. When Microsoft tested it against five years of real, previously reported bugs in two of the most heavily reviewed parts of Windows, it found nearly all of them on its own. Its first public results, in May, were 16 new Windows vulnerabilities, four of them critical. Microsoft isn't the only one doing this. The same class of AI tools is available to security researchers, other software makers, and, as we wrote about in our post on [AI-discovered zero-day threats](https://www.rnits.com/blog/claude-mythos-ai-cybersecurity-zero-day-threats), to attackers. The attackers having it too is what should get your attention. Windows contains code that's decades old. Bugs have been sitting in it for years, waiting for someone patient enough to find them. AI has made patience cheap. Every bug Microsoft's AI finds and fixes is one an attacker's AI can't use later. Every bug that's fixed but never installed on your machines is now a documented, public weakness with a patch that tells attackers exactly where to look. The race that matters for your business now runs from the day a fix is published to the day it's installed on your computers. ## What 1,400 fixes means for a small business If you're a 20-person accounting firm in Nashua or a dental practice in Lowell, you don't care about CVE counts. You care about whether your computers work on Monday and whether someone can break in. Here's how the new volume touches both. ### You can't pick and choose which fixes to install A reasonable reaction to 1,400 fixes is "just install the important ones." Fortra's Tyler Reguly made a similar point after the release: less than 1% of the Microsoft vulnerabilities patched this year are known to have been exploited, and only 26 of them made CISA's must-fix list. Focus on those, he said, and treat the rest as background noise. That's the right way to think about risk. The catch, which several IT admins pointed out in response, is that Microsoft doesn't ship fixes individually. Windows updates come as one cumulative package. You can't install the fix for CVE-2026-96951 and skip the other 1,100 Windows changes. You install all of it or none of it. So "important ones first" ends up being a decision about speed: how quickly the whole bundle reaches which machines. ### Bigger updates mean more chances something breaks Every fix changes code. Change 1,400 things at once and the odds that one of them conflicts with your line-of-business software, your printer driver or your scanner go up. Most months nothing breaks. Some months a QuickBooks add-in stops loading or a label printer goes silent. Stopping updates would be the wrong fix. The right one is testing on a few machines before you update all of them, which is exactly the step most small offices skip. ### "Automatic updates are on" isn't the same as patched Most small businesses we look at have Windows Update turned on and assume that's the end of it. Then we check, and find: - Laptops that haven't rebooted in six weeks, so updates downloaded but never installed - A front-desk PC someone set to "pause updates" during a busy week and never unpaused - A server nobody updates because "it runs the accounting system and we don't touch it" - A Windows 10 machine in the back office that stopped getting security updates entirely - Office installs stuck on an old update channel None of those show up as an error. The computer works fine. It's just quietly missing months of fixes. ### Old versions fall off faster than you think October also marked the end of security updates for Windows 11 version 24H2 Home and Pro. A PC on that version that hasn't moved to a newer release stopped getting fixes this month, including this month's 1,400. If your business bought "Windows 11 Pro" machines in 2024 and nobody has managed their feature updates, check them. Then there's Windows 10. Microsoft quietly extended its consumer Extended Security Updates program to October 12, 2027. That extension is for home users. Businesses get Windows 10 security updates only through the paid commercial program, priced per device, with the price going up each year. If you still have Windows 10 machines, they're either enrolled in something specific or they're not getting fixes at all. Treat October 2027 as a hard deadline to be off Windows 10, not as a reason to wait. ## How patching should work now Here's the process we use for clients. None of it is exotic. The difference is that it runs every month, on every machine, and somebody checks the results. 1. **Read the release before installing it.** Within a day of Patch Tuesday, someone should know whether anything is under active attack, whether it touches software you run, and whether early reports show problems. October's answer was clear: the Windows Shell zero-day goes out fast. 2. **Pilot first.** Push the update to a small group of machines that cover your critical software: one in accounting, one at the front desk, the person who uses the weird scanning app. Give it a day or two. 3. **Roll out to everyone on a schedule.** If the pilot is clean, the rest of the workstations go next, then servers in a maintenance window. When something is being actively exploited, that whole cycle shrinks from a week to a few days. 4. **Force the reboot.** Updates aren't installed until the machine restarts. Set a deadline, warn users, and restart machines that blow past it. Six weeks of "remind me later" is how a patched network becomes an unpatched one. 5. **Check every machine, every month.** Pull a report that shows which devices are current and which aren't. The machines that failed are the only ones that matter, and you won't know which they are unless something tells you. 6. **Don't forget everything that isn't Windows.** Browsers, Adobe, Zoom, Java, your firewall, your network storage box. Attackers don't care which vendor wrote the hole. Our post on [firewalls and VPNs as ransomware entry points](https://www.rnits.com/blog/firewall-vpn-appliance-ransomware-entry-point) covers why the network gear matters as much as the laptops. ## Questions to ask whoever handles your IT If someone else manages your computers, whether that's an IT company, a part-time contractor or the office manager who's "good with computers," here are fair questions to ask this week: - **Was the Windows Shell zero-day (CVE-2026-96951) installed on every machine, and when?** The answer should come with a date, not a "should be." - **Can you show me a report of which machines are fully patched right now?** You want to see an actual list of devices, not a reassurance. - **Do you test updates on a few machines before rolling them out to everyone?** - **What happens to a laptop that hasn't rebooted in three weeks?** - **Which of our machines are on Windows 10, or on a Windows 11 version that no longer gets fixes?** - **Who patches the server, the firewall and the third-party apps?** Vague answers are worth taking seriously. A loose process could get by at 100 fixes a month, and it falls apart at 1,400. ## What this does to your cyber insurance Insurance carriers have noticed the same trend. Applications now routinely ask how quickly you apply critical patches, and some ask for proof. If you tell an insurer you patch critical vulnerabilities within 14 or 30 days and a breach later traces back to a machine that hadn't been updated in three months, that gap can become the reason a claim gets questioned. We covered the broader requirements in our [cyber insurance post](https://www.rnits.com/blog/cyber-insurance-requirements-2026-smb-denied). If you're filling out a renewal this fall, make sure the patching answer is true, and that you can prove it. ## The part you can control AI is going to keep finding bugs, and the monthly numbers will probably keep climbing. You can't change that, and you shouldn't want to. Every bug Microsoft finds and fixes is one fewer that attackers get to keep. What you can control is how long the fix sits on Microsoft's servers before it's on your machines. For an office with a working process, that's days. For an office running on "automatic updates are on," it's often weeks or months, and nobody knows which machines are behind until something goes wrong. That process is what proper [software updates and patch management](https://www.rnits.com/services/software-updates-patch-management) is: testing, scheduled rollouts, enforced reboots and a monthly report proving every machine got the fix. It works best alongside [remote monitoring and management](https://www.rnits.com/services/remote-monitoring-management), so a machine that drops off or falls behind gets flagged the same day instead of at the next audit. If you'd like to know where your machines actually stand after October's release, RNITS will check for you. Start with a [free cyber security audit](https://www.rnits.com/free-cyber-security-audit). We'll show you which devices are missing updates, which are on versions that no longer get fixes, and what to deal with first. --- **RNITS** — New Hampshire & Massachusetts (onsite within 150 miles of Tyngsboro, MA); Virginia (onsite within 150 miles of our Richmond-area office); Georgia, Florida, and the rest of the US served remotely RNITS (The Rnits Company) · 404 Middlesex Road, Suite 9, Tyngsboro, MA 01879 · (978) 226-8931 · info@rnits.com Contact: https://www.rnits.com/contact · Free cyber security audit: https://www.rnits.com/free-cyber-security-audit