Microsoft Plugs Nearly 400 Security Holes
Summary: Microsoft released updates fixing at least 398 security vulnerabilities across Windows and supported software, including 42 rated critical and one zero day, CVE-2026-68820, a privilege escalation flaw in the afd.sys driver that is already being actively exploited. Microsoft attributes the rising patch volumes to AI-assisted vulnerability discovery, and 1Password research cited here found LLMs generating patches that failed to fix the flaw or introduced a new weakness more than half the time.
Key Takeaway: Only one of the nearly 400 flaws is known to be actively exploited, and that one is a driver sitting behind socket connections on effectively every Windows endpoint - a foothold-escalation step that arrives after an attacker is already inside. With AI finding bugs faster than humans can safely fix them, the pressure lands on the teams testing and rolling out these bundles, not on the patch count itself.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-62832CVE-2026-68820CVE-2026-72971
- Related
- CVE-2026-68820: Microsoft Windows Ancillary Function Driver for Win Sock Use-After-Free Vulnerability Known Exploited Vulnerabilities · Aug 11, 2026