A Record-Breaking Patch Tuesday for June 2026

Summary: Microsoft released updates for nearly 200 security holes across Windows and supported software in June 2026, a record for its monthly Patch Tuesday cycle, with nearly three dozen rated critical and public exploit code available for at least three. The zero-days include CVE-2026-49160, a denial of service flaw in web servers including IIS reported by OpenAI's Codex, and CVE-2026-50507, a BitLocker elevation of privilege bug tied to researcher Nightmare Eclipse, who has pledged a further zero-day drop on July 14.
Why it matters: Rapid7's Adam Barnett noted Microsoft also patched 360 browser vulnerabilities this month, an order of magnitude above recent norms, and the researcher Nightmare Eclipse has promised a 'bone shattering' zero-day release on the same day as next month's Patch Tuesday.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-45586 CVE-2026-49160 CVE-2026-50507
Related: Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs Cyber Risks ·
New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026