Microsoft Breaks Another Patch Tuesday Record (bleepingcomputer.com) 63
Microsoft's September 2026 Patch Tuesday is its largest ever, fixing a record 966 vulnerabilities, including 105 rated critical and two zero-days already being exploited in attacks. BleepingComputer reports: This Patch Tuesday addresses 105 "Critical" vulnerabilities, 81 of which are remote code execution, 20 are elevation of privileges, 2 are information disclosure, and 1 security feature bypass.
The approximate number of bugs in each vulnerability category is listed below:
- 438 Elevation of Privilege Vulnerabilities
- 19 Security Feature Bypass Vulnerabilities
- 258 Remote Code Execution Vulnerabilities
- 173 Information Disclosure Vulnerabilities
- 56 Denial of Service Vulnerabilities
- 16 Spoofing Vulnerabilities Last month, Microsoft's Patch Tuesday updates fixed 570 security flaws, following 400 vulnerabilities patched in August.
The approximate number of bugs in each vulnerability category is listed below:
- 438 Elevation of Privilege Vulnerabilities
- 19 Security Feature Bypass Vulnerabilities
- 258 Remote Code Execution Vulnerabilities
- 173 Information Disclosure Vulnerabilities
- 56 Denial of Service Vulnerabilities
- 16 Spoofing Vulnerabilities Last month, Microsoft's Patch Tuesday updates fixed 570 security flaws, following 400 vulnerabilities patched in August.
81 remote code execution? WTF? (Score:3)
That seems very bad even for Microsoft. Have they been vibe-coding or what?
Re: (Score:3)
That seems very bad even for Microsoft. Have they been vibe-coding or what?
Yes, but only the patches.
They found vibe-coding the core code only created..more patches.
Which someone finally bitch-slapped the shit out of the marketeer who was selling that crap as a good thing.
Re: (Score:3)
Yes, probably. There is evidence making patches with LLMs often opens other issues, unless you review very carefully.
Re: (Score:2)
That said, with the mountain of technological debt that MS is lugging around, we may have a case here where patching by LLM (or even manually) cannot bring the number of bugs down or reduce their severity, but can only make things worse. This was, as far as I know, only a theoretical scenario for any mainstream software so far. Well, looks like MS may have done something for Science. If so, the only thing that can fix this is throwing it away and starting over. With a time-frame of 10-20 years or longer. Th
Re: (Score:3)
If so, the only thing that can fix this is throwing it away and starting over. With a time-frame of 10-20 years or longer. That will not go well.
That go-back-and-rebuild-better will never happen for any currently deployed aspect of our global civilization again. At least not by human choice. It would only happen after some tangible event like some silicon-melting alien EMP attack or circuit-devouring nanobot swarm goes rogue.
It's the same thing as that quote that goes something like, "The economy can stay irrational longer than you can stay solvent".
The data centers can stay cycle through coprophagic tokens faster/longer than you can stay solvent.
Tw
Re: (Score:2)
And the next truth is, they dont care about OS anymore. Cloud is all they care about. If you notice, not much has been innovated or iterated on Windows OS in the past 5-10 years. Its been more of a maintain and then slap in some online related bullshit to feed their ad revenue, or link to their online services that they want you to eventually move to.
MS is not doing much as a company in the home space, except to try and pull as much info
Re: (Score:2)
But here is the thing: MS cannot run their cloud competently either, with several really bad hacks now and outages becoming more frequent. Without Windows, there is not a lot of reasons left to use the MS cloud. Exchange is one, but that is getting worse and worse as well.
Re: (Score:2)
Re: (Score:2)
Scarcely seems worth the effort in today's Slashdot, even when the FP is relatively good... But the aspect I've been failing to find so far in the discussion involves a different aspect or angle on that question. Something like "Are they sure?" or "How did they verify the bugs? Did they just ask another AI or were they able to construct test exploits?"
The recursive race to the bottom of bug fixes causing as many or more bugs than they cure is important. Sure, but... I suppose the worst case would be if the
Re: 81 remote code execution? WTF? (Score:2)
Re: (Score:2)
Apple has done it with OSX. Hence it can be done. It is hard though, slow and expensive.
For MS to try this (if they do they very likely will fail, they have proven time and again they cannot even do a filesystem), this would require the cost of using Windows to become extreme. It is on its way there, but relatively slow. The alternate scenario is that anybody that needs reliability moves to Linux or one of the free BSDs and Windows just gets worse and worse.
Re: (Score:2)
Apple has done it with OSX.
What? Apple did it with OSX, which is based on NeXTStep, which is based on Mach and FreeBSD? They absolutely did not do it with OSX. They dusted off NeXTStep, fucked up the interface, and made the necessary technical improvements to its ancient legacy codebase to make it function in the modern world... no better than any other legacy OS.
Re: (Score:2)
It was not me that claimed a rebuild was needed. What is needed is a different base that is not fucked up. It can be made from existing stuff.
Re: (Score:2)
What existing stuff is not fucked up? We need a software architecture that puts security first, whether that's microkernel-based or whatever else. And we need to rethink the way we handle speculative execution as well. We need substantive changes, not further rearrangement of deck chairs and a declaration of victory.
Re: (Score:2)
Well. At this time, the Linux kernel and the x-BSD kernels are not fucked up or not too much so and they are all actively and competently maintained. I do have some concerns about how the Linux kernel is growing, but that seems to not be too bad yet. The typical GNU user-space (without crap like systemd) is also in pretty reasonable shape, at least if you do competent system admistration.
I do agree that we cannot declare victory. We will have to be very careful and especially keep adversarial security resea
Re: (Score:2)
Rebuild is never as good as testing in a live environment. It makes you wonder those if Microsoft is patching 966 and Apple is patching 2 a month or so.. what is Apple and others missing. There has to be attack vectors targeted towards their systems as well.
Re: (Score:3)
I recall seeing a study many years ago into how likely a bug fix was to introduce a bugs. Their conclusion was that the more lines of code you have, the more likely that was to happen. The numbers given were that at one millions lines of code, each bug fix would, on average, introduce 1.2 new bugs. Windows, at that point (XP?) had 400 million lines of code.
Re: (Score:2)
This has been a low-key research issue for as long as large software systems are around, hence for 30-40 years or so. LoC is not a good metric though. The problem we have if they are using LLMs for patch generation is that apparently LLM-written patches will introduce many more new bugs than human-made ones and apparently even regressions. We have no numbers on this, but some experiments had really bad effects even on smaller projects. Obviously, LLM code being hard to review for humans makes things worse.
A
Re: (Score:2)
That seems very bad even for Microsoft. Have they been vibe-coding or what?
More than likely these vulnerabilities have been there for a while, but they started to use AI to find them. Hence why they were able to find so many in this cycle.
Re: (Score:2)
Even Linus has recognized the value of using AI to find vulnerabilities - provided that actual programmers review every single line before submitting it.
Re: (Score:2)
Well, you have to do it because the attackers have LLMs as well. Overall negative worth and the situation would be better without AI (as so many other things), but since AI is available you have to do this crap. What you should most definitely not do is let an LLM write the patch. That has a very high risk of causing more problem or being only a partial fix.
Re: (Score:2)
Like in Linux kernels. So many!!!!!!
Re: (Score:2)
Re: (Score:2)
Nah, it's just the result of them using AI tools to find vulnerabilities. The thing to be worried about is that nobody is publicly throwing as many AI tokens at Linux and other critical open source code. I say publicly because I'm sure privately many security agencies and criminal enterprises (but I repeat myself) are doing it.
Re: (Score:2)
They're "vibe-fixing" it now.
LLMs are pretty great at finding exploits, and by pretty great i mean they do more than 0% of success and you can engineer around it.
It don't matter if the LLM is only correct 1% of the time, because you can test every exploit, and the ones that actually work, well, they go to the list to be checked by humans.
So if it's the 1% i'm talking about and they "find" 10000 exploits, that's still 100 real exploits.
It probably should be a mandatory build step when vibe coding.
Like you le
Hospital (Score:2)
Also took down the PACS server at our local hospital. The D drive didn't mount after this update.
Re: (Score:2)
Re: Hospital (Score:2)
I wonder what the record is for most bugs introduced on a patch Tuesday?
Re: (Score:2)
Re: (Score:2)
How many recent bugs is this now 3000?
Don't know, but I use to make jokes about how often Windows needed a reboot. If I apply every Linux kernel patch when it comes out now it makes MS look good.
Re: (Score:3)
I don't know why this is being treated as a bad thing. I mean, it's bad that attackers can do the same, but that's a Red Queen's Race anyhow.
Re: (Score:2)
They may be introducing more problems now than they fix. Above some level of technological debt and complexity that happens.
Re: (Score:2)
Very true, but we don't know where that level is with AI assisted debugging yet. It's likely higher than it used to be.
Re: (Score:2)
From available, preliminary results, that level is likely a lot lower for LLM-generated patches, as they seem to introduce a lot more bugs, vulnerabilities and even regressions than human-generated patches and, on top of that, increase code complexity more than human-made patches. My take is that there is a real risks several large code-bases will become unmaintainable because of too much LLM use in the next years. Windows may well be one of those.
Re: (Score:2)
Re: (Score:2)
Yes, these have to be fixed. But what process and which people are used matters a lot.
Hence, get competent, experienced (and, yes, expensive) humans to fix things. Keep management out of it and let the engineers make the decisions. At the same time, invest a lot in reducing complexity and improving resilience. That probably is the only way to survive this effect. A re-design (as Apple did with OSX) needs to be done before things become bad and it seems to be too late for that now.
Yes, that will cost in the
Re: (Score:2)
Maybe you're right, but we can't know. We're on the outside.
Microsoft's success has put it into a bind. If they rebuild Windows from scratch, they'll face endless compatibility issues. I don't know how they should approach that. I ju
Re: (Score:2)
Having LLMs check the code for vulnerabilities seems to be helping all around.
I don't know why this is being treated as a bad thing. I mean, it's bad that attackers can do the same, but that's a Red Queen's Race anyhow.
I did not say it is a bad thing, just that this is hardly unique to MS. My Ubuntu 24.04 server for instance had ~70 patches two weeks ago and 100 more last week, and it does not even have a GUI. I fully expect similar numbers this week, and this has been going on for a while. But yes, hopefully even the most obscure bugs in all the popular existing code will eventually be found and then the pace of discovery will slow down and we will all get to enjoy exceptionally secure software going forward. Cough.
Re: (Score:2)
I think it will slow dramatically over the next year or so. Then shoot back up again after someone comes up with something crazy like a rowhammer-like attack on packets or some other seemingly impossible technique.
Re: (Score:2)
Oh! No, sorry about that, I must have phrased it poorly. I wasn't directing that at you but in agreement with you.
I think it will slow dramatically over the next year or so. Then shoot back up again after someone comes up with something crazy like a rowhammer-like attack on packets or some other seemingly impossible technique.
No prob. Open source was certainly first to get the AI debugging treatment. I'm sure all the most critical code - OpenSSH, OpenSSL, Netfilter, etc - as well as the Linux kernel have been gone over pretty thoroughly by now. Other widely deployed code like nginx and ffmpeg likewise. The large companies with a lot of closed source code like MS are using the same tools and doing what we are discussing here in this thread, so hopefully they will be caught up soon as well. I have heard experts say they expec
Re: (Score:2)
Re: (Score:2)
I don't know why this is being treated as a bad thing.
Because it's Microsoft, and is, therefore, Satan's urine on the heads of smart people like AC. Just ask him.
If they literally started raising the dead on live television, the "I hate M$" crowd would bitch about them desecrating a corpse.
Re: (Score:2)
It's kinda sad though to see people letting the bugs in their ass override reason. If someone wants to have a software company, fine, but learn to compartmentalize. Don't act like it's bad that vulnerabilities are being fixed. But, there are people who treat OS selection like a virtue signal, so... I don't know, c'est la vie.
Re: (Score:2)
I've seen a lot of updates on several Linux servers recently, but only two in the last couple of months that required a reboot.
Re: (Score:2)
Re: (Score:2)
I check every day. I suspect Ubuntu bundles stuff together to reduce the total number, at least on the LTS server.
Re: (Score:2)
Re: (Score:3)
How many recent bugs is this now 3000?
Yeah, but that unlocked the YouTube channel level called Mystery Patch Theatre 3000..
Too many words (Score:3)
You could have stopped at Microsoft Breaks. We just found a previous update from Microsoft breaks the cellular connection in some of our HP laptops. The update flips the IMEI back to the default. We had to get a patch from HP to fix the update.
Reframing the security holes (Score:2)
They are FEATURES designed to share all your data with the entire world. People just need to figure out how.
Keeping my Windows 11 laptop off for a few days. (Score:3)
I have a Windows 11 laptop that I use occasionally. My daily driver runs Linux.
I'll keep the Windows 11 laptop turned off for a few days for any fallout to occur and bad patches to be pulled.
crap (Score:2)
I wonder how many things they break. :(
Lets not overlook.... (Score:1)
The fact that there were over 100 patches and 80 of them were for remotely exploitable bugs. The average ratio had been exactly the reverse the entire lifetime of the web for all OS's until now.
Loving Linux more and more :) (Score:1)
I'm loving Linux more and more. I have Linux Mint Cinnamon on 2 Laptops and Linux Zorin on another. Now Windows 11 is my bottom third OS only because there's a few Windws Apps still needed. It's so relaxing to NOT to have Windows stop me for very rude updates, in the middle of my work that can take hours to setup, reboot then reboot again.
Re: (Score:2)
I also use Mint and have noticed the updates there are running a higher rate than usual too. The AI can firehose end product around so effectively that everyone is finding vulnerabilities. Apple is not exempt either.
This is a good thing (Score:2)
The new AI tools are making it easier to find problems
And.... (Score:2)
On another, it nuked the camera, PIN, password, the password recovery questions. Wouldn't let me past the login screen.
But it served up advertisements on the login screen. Took a week with my IT guy to fix it. Still not quite right, keeps nagging me about Teams and Onedrive.
Microsoft Bug Hunt--Like Shooting Fish in a Barrel (Score:2)
Windows 11 - Gruyere edition (Score:2)
Our promise: you don't need a fan to cool your computer down - all those holes make passive cooling a reality!