Microsoft's Patching
Schneier on Security, Monday, September 14th, 2026
September's Patch Tuesday fixed a record ~972 vulnerabilities, evidence that AI vulnerability finding favors defenders for now.
Microsoft's September update set a record with roughly 972 vulnerabilities fixed, 112 of them critical, after patching a then-record 570 two months earlier and about 620 last month; Google and others have also published record numbers.
Two weeks prior, OpenAI, Anthropic, AWS, Google, Microsoft and 100 other organizations published an open letter warning of a narrowing patching window ahead of AI-enabled attacks that exploit flaws first.
Schneier reads the surge as the result of AI-powered vulnerability finding and a good example of AI helping defenders more than attackers.
His prediction is that counts will keep rising as AI improves and then fall as the models run out of vulnerabilities to find, with the peak and the rate of decline unknown.