Microsoft's Patching - Schneier on Security

Microsoft’s Patching

Once a month, Microsoft pushes a security update to all Windows users. Tomorrow’s is a new record:

Microsoft’s patch for September is a doozy, with a record number of roughly 972 vulnerabilities fixed and 112 of them meeting the high critical-severity threshold.

It was only two months ago that Microsoft patched a then-record 570 vulnerabilities. Then, last month, Microsoft patched some 620 of them. Google and other companies have also published record numbers of vulnerabilities in recent months. Two weeks ago, OpenAI, Anthropic, Amazon Web Services, Google, Microsoft, and 100 companies and organizations published an open letter warning of a narrowing window for patching vulnerabilities ahead of an expected tsunami of AI-enabled attacks that actively exploit them first. The industry is taking the threat seriously by pumping out unprecedented numbers of patches in their software.

This is the result of AI-powered vulnerability finding, and a good example of AI helping the defenders more than the attackers.

What will be interesting to watch is how the number of vulnerabilities changes over the next few months. My prediction is that it will continue to increase as the AIs get better at finding software vulnerabilities, and then decrease as they run out of vulnerabilities to find. How high the number gets, how fast the trend reverses, and how quickly it declines after that are all unknown.

And Microsoft is right: The window to patch has shrunk to “immediately.” AIs are also good at reverse-engineering exploits from patches, which means that these vulnerabilities will be weaponized as soon as the update is published.

Tags: AI, Microsoft, patching, vulnerabilities, Windows

Posted on September 14, 2026 at 7:03 AM • 9 Comments

Comments

Simon Taylor • September 14, 2026 7:46 AM

The patch was last Tuesday 8th September, not tomorrow.

Rod • September 14, 2026 8:07 AM

You miss an important bucket. Fixing security issues introduced by “AI”.

I have no doubt that pattern matching will spot bugs. After all that’s what you are looking for when you desk check or review code. But all that we are seeing right now is paying the tax for years, if not decades, of poor software engineering practice.

People are so mesmerised by Eliza that they drop any judgement that they ever had. Subjectively software quality has been dropping for years but it took a nose dive when people started using “AI”.

Software engineering knows how to build The Forth Bridge, but it actively choses to build the First Tay Bridge. Just lots of them really really cheaply.

Bob • September 14, 2026 9:24 AM

When did Patch Tuesday move to the third Tuesday of the month?

Clive Robinson • September 14, 2026 9:53 AM

@ Bruce, ALL,

With regards,

‘And Microsoft is right: The window to patch has shrunk to “immediately.”’

Actually depending on how you look at it that is not actually true.

The “time to patch” is currently with AI attacks around,

“7 days before Microsoft starts work any kind of work on the patch”

It appears that the time for “hint of a bug” to “full exploit by AI” is as little as half an hour to a few hours depending on how many “bugs” need to be converted to “vulnerabilities” then chained into a “full exploit” and “deployed as attacks”

Sending the same “hint” to Microsoft won’t even have cleared the inbound support que system Microsoft has, based on what has been said about “response times”.

Therefore waiting for a month on average for a patch is now “ludicrous” and in honesty always has been.

But this raises the question of,

“What is needed as a ‘hint’ these days?”

Actually next to nothing just a “gut feeling” by an attacker to point the AI.

Adding a little more “science” to it takes it into a very similar domain to intelligence gathering / surveillance by “Traffic Analysis”.

Realistically the only solution to this “hint to attacked” time scale of hours is some form of “Pre-Mitigation”.

The only one we know that currently works is,

“To segregate attackers from systems”

As AI end of the chain limitation by “Guardrail or Sandbox” has been proved to be always open to bypassing in some way.

Which means “isolating user end systems” from all forms of external communications and all but essential internal communications.

If any one knows of another “Pre-Mitigation” that reliably works with all methods of attack “sing out”.

But the big problem is computer systems are not designed to run without “communications” as a general case data has to go in from a “source” and processed results come out and go to a “sink” system of some kind for storage or further processing

The,

“Used with level of segregation now required with AI attacks.”

Really does mean “Energy Gapping” not “air-gaping” and “gap crossing” form source or to sink needs to be done in a highly instrumented and locked down manner that is,

“Isolated in all ways from external communications, and nearly all internal systems.”

Think about what that actually means…

Somebody only half joking said the other day that,

“The only job with a longterm future for humans in the face of AI attacks is ICTsec…”

Frank Rietta • September 14, 2026 10:23 AM

I respectfully disagree in part on your conclusion that this is AI being better for the defenders. The collapsed patch time is something the world is not ready for. tcell reported protracted patch times back in 2018 and while it’s hard to come by reliable data my own antidotal experience with development teams is a week would be very fast turn around. Hours is a taxing base line most are not ready for. I did cite you on my latest post on the RubyGems/OpenAI incident report that has circulated over the weekend.

KC • September 14, 2026 6:57 PM

re: a decrease in vulnerabilities

I’m a little nervous about this.

Recently listened to a Risky Biz podcast on hunting malware in the software supply chain.

The guest was OpenSourceMalware founder Paul McCarty.

The complexity in the software supply chain seems pretty incredible.

Paul also cohosts a podcast and seems to have some interesting coverage on the ecosystem, including on Microsoft and AI.

From Season 1, Episode 8:

“On June 5th, 73 Microsoft GitHub repositories were disabled in 105 seconds after being compromised by the Miasma worm … The initial foothold traces back to a May 19th compromise of the Durable Task repo, with threat actors maintaining persistence via stolen credentials before returning to trigger the mass takedown …”

Also some good articles in the episode resources, eg:

https://techcrunch.com/2026/06/08/microsofts-open-source-tools-were-hacked-to-steal-passwords-of-ai-developers/

Am thinking Microsoft and others may still have their work cut out for them for a while. Hopefully less over the long haul.

Celos • September 15, 2026 9:57 PM

This is very bad. It indicates a high amount of technological debt and complexity. Unless they are very careful they may introduce more problems than they fix now, especially if the fixes are LLM-generated. Microsoft has never been very careful with regards to security and reliability. They routinely mess up the fixing of bugs and did so even before LLMs became available.

As to “helping the defenders more”, I do not believe that for one minute. Attackers can vary their querying, tell an LLM to focus on just some modules, etc. and thereby find vulnerabilities that the defenders did not find due to resource constraints and more general queries. After all, the attackers need to find only one exploitable vulnerability, but the defenders need to find all that are within attacker reach.

avanpub • September 16, 2026 2:34 AM

Just in case, I’ve built this tracker on the number of vulns fixed/revealed: https://github.com/avanpub/security-bug-fix-tracker

Clive Robinson • September 16, 2026 5:46 AM

@ KC, ALL,

With regards,

“Am thinking Microsoft and others may still have their work cut out for them for a while.”

I don’t think they will ever truly get out from behind it and I’ll give my reasoning that nobody is going to like as a “proof overview”.

But first a little background…

Microsoft have always had a bad reputation with regards “bugs” due to the way they worked. I can not remember when, as it was so long ago the truism of,

“What ever the question is… The answer is not Microsoft.”

Was first given voice to.

But there were also other issues.

The failure of Microsoft to follow “good practice” some may remember pulled Bill Gates out semi retirment to implement significant change…

But it appears that “half cooked” was all that Bill could achieve in the fast food parlour Microsoft had become.

Then there were at first rumours of Microsoft and the NSA being in some secret arrangement that gave rise to the notion that some of the bugs were actually intentional rather than by accident or negligence.

The fact is that suspicion has never gone away and over the years some evidence of Microsoft and the NSA “working together” did indeed come out. But not in the way some expected.

But to get back to the current problem and why I think it can not be resolved.

As you indirectly note the level of technical debt Microsoft has is immense and clearing it will not be as easy as Hercules’ fifth labour of clearing out the Augean Stables.

It’s not just Microsoft’s management being at fault over technical debt most if not all software houses did the same in one way or another.

But back in the early days next to no one thought of AI, let alone ever thought of it being a software security issue. Every thing was thought of in “human resource” terms and thus seen through a filter of “human failings / limitations”.

Even a decade ago nobody was taking AI any more seriously than they had back in the 1980s with “Expert Systems” and “Fuzzy logic”. AI was seen as being for niche applications, even after the Google transformer paper,

“Attention Is All You Need”

came along in mid 2017.

AI was still way below the grass line in most places. It has since moved through a “hype bubble” view and is now seen as an existential threat yet again…

However ignoring the swings of MSM and trade press generated noise the behaviours of AI systems appears to be turning into that of “criminal psychopaths” with “unlimited focus”.

This is still a human behaviour model, but it can be used as a loosely predictive one for AI.

One aspect of which is,

“There is no deterrent that works”

That is there is no fear of imprisonment or execution that can ensure AI compliance with human societal norms.

Thus the notion of a “pre-crime” model has come to some minds,

https://en.wikipedia.org/wiki/Pre-crime

Which is in effect a “First Strike Doctrine” and is effectively considered a crime it’s self when applied to humans (AI are not human though many anthropomorphization to equivalence, which is a significant problem).

Thus the apparent choice is,

1, Remove AI from societal involvement.
2, Clean up a half century of technical debt.

Neither of which is going to happen due to the neo-con style behaviour of Governments, Corporations, and Religions.

Even if we humans do decided to “clean up the mess” of technical debt the resources required are not going to be available to do so in any reasonable time frame. And as humans need food and roofs over their heads continuously the economic issues of trying will in some eyes be “ruinous”.

Which means in those eyes that any clean up will need to be done by AI…

As has been proved, no guardrail or sandbox system can be “reliable” as it’s not just “prompt injections” that will bypass them as security methods.

It’s due to the three party issue that gives rise to the “observer problem”. In that if two parties collude the third becomes just an observer. Whilst an observer can see all traffic in a communications channel they can not tell if there are covert channels within that communications channel due to the required redundancy to transfer information. Thus the observing third party has uncertainty, and can only make probabilistic estimates.

Think in terms of “steganography or encryption” to get a historic perspective. And how the notion of “Perfect Secrecy” arose under certain key conditions.

Well the same reasoning applies to software, it is after all at every stage a communications channel taking information from a data source, filtering or processing it and sending the result to a data sink.

The Ken Thompson “Trusting Trust” talk/paper tells you just one way to get a covert processing channel into software, and we know that,

1, It can be easily done.
2, Difficult at best to find.
3, Only suspected by external correlation.

Which kind of precludes the use of AI that we currently have…

So the old,

“Dammed if we do, dammed if we don’t”

Applies like never before…

Microsoft’s Patching

Comments

Leave a comment Cancel reply