Microsoft’s September Patch Tuesday has reset the scale of the monthly security grind. By Zero Day Initiative researcher Dustin Childs’s count, the company fixed roughly 972 vulnerabilities—997 if Chromium fixes shipped through Edge are included—with 112 rated critical.¹

The total eclipsed the previous record of 570 fixes set only two months earlier. Microsoft has now patched 2,760 vulnerabilities this year, more than twice last year’s count; at the present pace, its annual tally would exceed the combined totals of 2023, 2024 and 2025.¹

Childs called the swelling volumes the “new normal.” He praised the teams doing the repairs, but paired that with a sharper warning: “AI-assisted vulnerability discovery shows no signs of slowing down. However, we have not seen a correlating spike in active exploits—yet.”¹

This month’s stack includes two actively exploited zero-days, alongside flaws with potentially severe consequences. One Exchange Server bug could let an unauthenticated attacker execute code by sending a malicious Visio attachment; another affects Remote Desktop Services and carries a 9.8 severity score. Childs said he stopped counting wormable bugs after reaching 20—flaws capable of spreading machine to machine without user interaction.¹

The wider industry has already framed the trend as a race against time. Two weeks before the release, major AI and cloud companies joined an open letter warning that the window to patch weaknesses could narrow before AI-enabled attackers begin exploiting them at scale.¹

There is a counterargument to the alarm: AI bug-hunting remains expensive, can generate false positives, and gives vendors an incentive to promote tools built on their own costly models. Yet proponents point to the escalating discovery numbers, including Mozilla’s report that its Mythos-assisted researchers found 271 vulnerabilities with almost no false positives. The hard question is no longer whether the patch mountain is real, but whether it is evidence of control—or of an oncoming flood.¹