1,400 Patches in One Day: AI Just Changed the Patch Tuesday Math

On October 13, Microsoft shipped the biggest Patch Tuesday in its history: more than 1,400 CVEs in a single release. Depending on whose count you use it's somewhere between 1,407 and 1,416. A year ago a typical month was a couple hundred. If your patch strategy is still "sort by CVSS and work down the list," that strategy just stopped working.

Four months, and the monthly count went up seven times

This isn't one weird month. The trend has been building all summer. June was around 200. July jumped to nearly 600. September came in around 970, and October cleared 1,400. Computer Weekly points out that October alone listed more CVEs than all of 2023.

AI is finding old bugs faster than humans ever did

Microsoft and other vendors have been running AI-assisted vulnerability research across their codebases this year, and a lot of what they're finding is bugs that have been sitting in legacy code for years. Dustin Childs of the Zero Day Initiative described it plainly in his Patch Tuesday review:

"It's accelerating bug-hunting on both sides of the fence."

Here's my take. Read that quote twice, because both halves matter. The good news is that defenders are finding and fixing flaws that attackers could have been sitting on. The bad news is that attackers have the same tools. Analysts at Tenable and Fortra both made the same point: the volume is mostly old bugs being surfaced, and only a small fraction of CVEs ever get weaponized. Fortra's Tyler Reguly put this year's known-exploited share of Microsoft patches at under 1%. So the job isn't "patch 1,400 things faster." The job is knowing which handful can't wait.

Four CVEs worth knowing by name

Notice that the one bug attackers are actually using isn't one of the 9.8s. That's the whole lesson in a single example. A CVSS score tells you how bad a flaw could be. It doesn't tell you whether anyone is using it against you.

How I'd work a 1,400-CVE month

1. Known exploited first. Anything on the CISA KEV list or flagged "Exploitation Detected" by Microsoft goes out now. This month that's the Windows Shell bug.
2. Exposed and unauthenticated next. Internet-facing services, email clients and anything that needs no login or user click. Think Outlook's Reading Pane and QUIC.
3. Publicly disclosed after that. Once details are public, proof-of-concept code usually follows.
4. Your crown jewels. Domain controllers, identity, SharePoint, SQL, hypervisors. A lower score on a critical asset can outrank a higher score on a kiosk.
5. Everything else on your normal cycle. Test it and ring-deploy it, but stop treating it as a fire.

Microsoft is clearly seeing the same problem. With this release it introduced 15 "risk cohorts" that group CVEs that raise the same questions about your environment, like remote access and RDP, or DNS and DHCP. Microsoft calls them experimental. They don't change patch guidance and they don't replace checking for active exploitation. They are, however, a sign that the vendor knows nobody can read 1,400 advisories one at a time.

What this means if you're studying for a cert

Vulnerability management used to be a checkbox topic. Now it's the job. CompTIA's Security+ (SY0-701) puts it in Security Operations, the largest domain at 28%, and describes it as identifying, analyzing, remediating, validating and reporting vulnerabilities. That's exactly the work this month demanded.

Before your exam, make sure you can explain each of these without notes:

• What Mark of the Web does, and why bypassing it is worth an attacker's time
• The difference between a CVSS score, exploitability and business impact
• Why "publicly disclosed" and "exploited" are separate flags
• What compensating controls you'd use for a system you can't patch yet
• How end of support changes your risk register

A final thought. Record Patch Tuesdays aren't going away. Every vendor with an AI security program is about to produce more CVEs, not fewer. The people who do well in the next few years will be the ones who can look at a wall of advisories and quickly find the five that matter. You can learn that skill, and it's exactly what good training should teach.

— Scott