Microsoft's September patch release marks a significant escalation in cybersecurity maintenance, addressing a record-breaking 972 vulnerabilities. When including the porting of Chromium browser fixes for Microsoft Edge, the total number of addressed bugs reaches 997. This release is particularly severe due to the inclusion of 112 critical-severity vulnerabilities. This surge follows a pattern of increasing patch volumes, including 570 vulnerabilities two months ago and 620 last month. Consequently, Microsoft has remediated 2,760 vulnerabilities so far this year, a figure that more than doubles its previous annual total and suggests that the cumulative yearly total will exceed the combined totals of 2023, 2024, and 2025. Industry experts, such as Dustin Childs from the Zero Day Initiative, suggest this spike represents a "new normal" driven by the acceleration of AI-assisted vulnerability discovery. While active exploits have not yet seen a correlating spike, an open letter from major tech entities including OpenAI, Anthropic, and Amazon Web Services warns of a narrowing window for patching as AI-enabled attacks threaten to exploit these flaws more rapidly. The unprecedented volume of patches highlights a defensive struggle to keep pace with the increasing efficiency of automated vulnerability identification.
Read original
arstechnica/ai