Patch Tuesday is the one monthly ritual where "personal best" is bad news. This month Microsoft didn't just clear the bar, it pole-vaulted over it wearing a cape.

570 Flaws, Three of Them Already Loose

Microsoft's July 2026 Patch Tuesday fixes a record-breaking 570 vulnerabilities — the largest single batch in the program's history. Three of them are zero-days: two actively exploited in the wild (an Active Directory Federation Services elevation-of-privilege bug and a SharePoint Server elevation-of-privilege flaw) and one publicly disclosed BitLocker bypass that lets anyone with physical access to a device peek at encrypted data.

The breakdown is its own small horror show: 254 elevation-of-privilege bugs, 145 remote code execution flaws, and 59 rated "Critical," nearly all of them exploitable enough to hand an attacker the keys to a network.

The Robots Found the Bugs This Time

Here's the twist buried in the scary headline number: Microsoft credits an AI-powered vulnerability discovery system with surfacing a big chunk of this month's haul. That's genuinely good news — it means defenders are getting better tools for finding holes before attackers do, not that Windows suddenly got 570 flaws worse overnight.

But it cuts both ways. The same week this record patch batch dropped, security researchers documented the first fully autonomous AI-run ransomware attack chaining together nothing but known, unpatched CVEs. AI is getting better at finding bugs for whichever side deploys it first — which makes "patch immediately" less of a suggestion and more of a survival instinct.

570 flaws fixed is a good month for defenders and a busy month for everyone's IT department. Go update your systems.

Source: BleepingComputer