Microsoft Plugs a Record 49 Security Holes
Summary: Microsoft issued 16 update bundles to fix a record 49 security vulnerabilities in Windows and other software, surpassing the previous record of 34 set in October 2009 and matched in June and August of that year. Symantec counted 35 of the flaws as remote code execution bugs, Microsoft said at least eight were publicly disclosed before the patches, and the release fixed one of the two remaining zero-day flaws exploited by the Stuxnet worm.
Bottom line: Thirty-five of the 49 flaws let an attacker run any command they wish on a vulnerable machine, and eight were already public before the fix shipped - so the window between disclosure and exploitation was open before many teams had even scheduled the patch.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026