Microsoft releases 419 security fixes, including 3 zero-days, amid AI-driven bug surge

Record-Breaking Patch Tuesday

Microsoft issued fixes for 419 security vulnerabilities, making it one of the highest monthly totals on record. This release included 62 critical and 357 important-rated issues. The company has surpassed its annual vulnerability record of approximately 1,250, with successive large releases in recent months.

AI's Role in Vulnerability Discovery

The significant increase in reported vulnerabilities is linked to the growing use of artificial intelligence in bug discovery. Microsoft previously noted that AI-powered vulnerability discovery has transitioned from speculative to an engineering challenge. This has led to a volume of patches about five times higher than typical monthly releases before AI-assisted methods became prevalent.

Zero-Day Exploits and Attributions

Among the patched vulnerabilities are three zero-days. Two were publicly disclosed before the patches were released. One of these, CVE-2026-68820, affecting a Windows network connection component, has been actively exploited in the wild. Microsoft attributed attacks exploiting this vulnerability to the Lazarus Group, which has been targeting job applicants in the defense, aerospace, and aviation industries with trojanized PDF readers.

Disclosure Practices Under Scrutiny

One of the publicly known flaws, CVE-2026-62832, was credited to an anonymous researcher. The details of this vulnerability align with a proof-of-concept named LegacyHive, published by the pseudonymous researcher Nightmare Eclipse shortly after the previous month's Patch Tuesday. This incident is part of an ongoing dispute regarding Microsoft's vulnerability disclosure and bounty practices.