Microsoft Corp.<\/strong> today released software updates to plug at least 570 security holes in its Windows<\/strong> operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence.<\/p>\n Nearly 60 of the bugs quashed in July\u2019s Patch Tuesday earned a \u201ccritical\u201d severity rating, meaning miscreants or malware could use them to seize remote control over a Windows device with little or no help from the user. Microsoft also addressed three zero-day flaws, including two that are already being exploited in the wild.<\/p>\n Two of the zero-day weaknesses allow an attacker to elevate their user rights on a Windows system, as do approximately 250 other elevation of privilege flaws fixed this month; they include CVE-2026-56155<\/a> \u2014 an Active Directory Federation Services<\/strong> bug \u2014 and CVE-2026-56164<\/a>, a Microsoft Sharepoint<\/strong> vulnerability.<\/p>\n CVE-2026-50661<\/a> is a security feature bypass in Windows BitLocker<\/strong> that could allow attackers to gain access to encrypted data if they have physical access to the device. Microsoft said this bug has been detailed publicly, but that it is not aware of any active exploitation.<\/p>\n In a blog post on July 9, Microsoft Executive Vice President Pavan Davuluri<\/strong> wrote that Windows users will notice \u201ca higher volume of security updates included in each security release\u201d as a result of AI aiding in the discovery of vulnerabilities.<\/p>\n \u201cThe pace of vulnerability discovery is changing with advances in AI making it possible to find more issues, faster, across more code, with new mechanisms that can accelerate both discovery and analysis,\u201d Davuluri wrote<\/a>.<\/span><\/p>\n Jack Bicer<\/strong>, director of vulnerability research at Action1<\/strong>, called attention to CVE-2026-48561<\/a>, a remote code execution flaw in Microsoft Copilot (with a 9.6 CVSS threat score) that allows an unauthorized attacker to execute code over the network. Microsoft says an attacker could exploit this bug by hosting a malicious website that causes Microsoft Edge for Android to automatically send crafted prompts to Copilot when a user visits the site.<\/p>\n As AI advances the state of vulnerability discovery and remediation, it is also making it easier for attackers to quickly devise working exploits for known software flaws. Microsoft has long labeled security bugs using its \u201cexploitability index,\u201d which is Redmond\u2019s best guess as to how likely it is that attackers will be able to figure out a reliable way to exploit a given vulnerability.<\/p>\n But Satnam Narang<\/strong>, senior staff research engineer at Tenable<\/strong>, argues that Microsoft\u2019s exploitability index needs to do a better job of shifting with the machine speed of discovery. For example, Microsoft originally gave this month\u2019s SharePoint zero-day an exploitability rating of \u201cless likely,\u201d although the flaw was added<\/a> to CISA\u2019s Known Exploited Vulnerabilities list on July 1.<\/p>\n \u201cAnthropic\u2019s Red Team\u2019s own findings for known vulnerabilities (n-days) revealed how fragile this system has become, with its Mythos Preview model being able to produce proof-of-concept exploits for 13 of 14 vulnerabilities that were rated \u2018Exploitation Less Likely\u2019 or \u2018Exploitation Unlikely,’\u201d Narang said. \u201cWhat this means is that our way of looking at Patch Tuesday has changed, because the exploitability index is centered around humans, not AI tools, and as these tools continue to improve, defense needs to improve alongside it.\u201d<\/p>\n Chris Goettl<\/strong> at Ivanti<\/strong> observed that the record patch numbers from Microsoft come as a number of other major software makers are increasing their patch cadence, including Adobe which announced today it is moving to twice-monthly security bulletins published on the 2nd and 4th Tuesday of each month (Adobe also cited AI for accelerating their patch cycles). Cisco<\/strong>, Mozilla<\/strong> and Oracle<\/strong> also are shipping updates more frequently, while Google\u2019s patch batches in June 2026 totaled more than 900 security fixes, Goettl noted.<\/p>\n Backing up your Windows system and\/or data is always a good idea before applying operating system updates. Given the volume of patches addressed this month it may be wise for end users to wait a few days before applying these fixes. It\u2019s not uncommon for security patches to introduce system stability issues, and those chances probably increase quite a bit with the gigantic patch count released today.<\/p>\n Further reading:<\/p>\n Action1\u2019s Patch Tuesday blog<\/a><\/p>\n![\"A](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2021\/07\/windupate.png?resize=749%2C527&ssl=1\")
<\/p>\n