Microsoft Patches a Record 570 Security Flaws (krebsonsecurity.com)
(Wednesday July 15, 2026 @11:00AM (BeauHD)
from the here-we-go-again dept.)
- Reference: 0184465034
- News link: https://tech.slashdot.org/story/26/07/15/042220/microsoft-patches-a-record-570-security-flaws
- Source link: https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/
An anonymous reader quotes a report from Krebs on Security:
> Microsoft today [1]released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its [2]record-smashing Patch Tuesday release last month . Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence. Nearly 60 of the bugs quashed in July's Patch Tuesday earned a "critical" severity rating, meaning miscreants or malware could use them to seize remote control over a Windows device with little or no help from the user. Microsoft also addressed three zero-day flaws, including two that are already being exploited in the wild.
>
> Two of the zero-day weaknesses allow an attacker to elevate their user rights on a Windows system, as do approximately 250 other elevation of privilege flaws fixed this month; they include [3]CVE-2026-56155 - an Active Directory Federation Services bug -- and [4]CVE-2026-56164 , a Microsoft Sharepoint vulnerability. [5]CVE-2026-50661 is a security feature bypass in Windows BitLocker that could allow attackers to gain access to encrypted data if they have physical access to the device. Microsoft said this bug has been detailed publicly, but that it is not aware of any active exploitation.
>
> In a [6]blog post on July 9, Microsoft Executive Vice President Pavan Davuluri wrote that Windows users will notice "a higher volume of security updates included in each security release" as a result of AI aiding in the discovery of vulnerabilities. "The pace of vulnerability discovery is changing with advances in AI making it possible to find more issues, faster, across more code, with new mechanisms that can accelerate both discovery and analysis," Davuluri wrote.
[1] https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/
[2] https://tech.slashdot.org/story/26/06/10/0337257/microsoft-smashes-record-for-biggest-ever-patch-tuesday-update
[3] https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-56155
[4] https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-56164
[5] https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-50661
[6] https://blogs.windows.com/windowsexperience/2026/07/09/evolving-windows-vulnerability-management-to-meet-the-speed-of-ai-powered-discovery/
> Microsoft today [1]released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its [2]record-smashing Patch Tuesday release last month . Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence. Nearly 60 of the bugs quashed in July's Patch Tuesday earned a "critical" severity rating, meaning miscreants or malware could use them to seize remote control over a Windows device with little or no help from the user. Microsoft also addressed three zero-day flaws, including two that are already being exploited in the wild.
>
> Two of the zero-day weaknesses allow an attacker to elevate their user rights on a Windows system, as do approximately 250 other elevation of privilege flaws fixed this month; they include [3]CVE-2026-56155 - an Active Directory Federation Services bug -- and [4]CVE-2026-56164 , a Microsoft Sharepoint vulnerability. [5]CVE-2026-50661 is a security feature bypass in Windows BitLocker that could allow attackers to gain access to encrypted data if they have physical access to the device. Microsoft said this bug has been detailed publicly, but that it is not aware of any active exploitation.
>
> In a [6]blog post on July 9, Microsoft Executive Vice President Pavan Davuluri wrote that Windows users will notice "a higher volume of security updates included in each security release" as a result of AI aiding in the discovery of vulnerabilities. "The pace of vulnerability discovery is changing with advances in AI making it possible to find more issues, faster, across more code, with new mechanisms that can accelerate both discovery and analysis," Davuluri wrote.
[1] https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/
[2] https://tech.slashdot.org/story/26/06/10/0337257/microsoft-smashes-record-for-biggest-ever-patch-tuesday-update
[3] https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-56155
[4] https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-56164
[5] https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-50661
[6] https://blogs.windows.com/windowsexperience/2026/07/09/evolving-windows-vulnerability-management-to-meet-the-speed-of-ai-powered-discovery/
Microsoft says 622 (Score:2)
by schwit1 ( 797399 )
[1]https://msrc.microsoft.com/upd... [microsoft.com]
"If people want a severity hook, July has 26 vulnerabilities with a CVSS base score above 9.0, and 13 of those sit at 9.8," said Josh Taylor, lead cybersecurity analyst at Fortra
[1] https://msrc.microsoft.com/update-guide/releaseNote/2026-Jul
Serious quality improvements (Score:2)
by gurps_npc ( 621217 )
I can easily see a day where every bit of software is subjected to an AI check before it is released.
There may come a day when hacking is far more rare and requires government level resources to pay for an AI better than the one software makers use.
There will always be vulnerabilities but they might only be visible to government spies.
Re: (Score:2)
by TwistedGreen ( 80055 )
Or you just hack into the Tessier-Ashpool mainframe if you can't afford to rent time on Wintermute
An AMAZING number of flaws (Score:2)
The big underlying issue is why does Microsoft deliver software with so many flaws?
Re: (Score:2)
It doesn't, they just turned AI on it for the first time.
Linux is going through the same thing, only with less good AI and more slowly.
Re: (Score:2)
MSFT wants to sell you and your enterprise the tools and capacity to bug hunt your own code and allegedly help you "drive costs" out of your operations. I suspect this is more of a "look, we are eating our own dog food!" exercise to drive sales.
They're trying to slap the copilot moniker on anything they can lay a hand on to further that goal. Someone's gotta pay for all that capex they're pushing into their datacenter infrastructure....might as well be you.
Re: (Score:2)
It's bad, but Microsoft has a awfully large number of lines of code to run through Mythos or whatever (whether they need that many is a whole other discussion). A more useful metric on overall code quality would be how many bugs are being found per 10k lines of code compared to their peers (including FLOSS); e.g. if Microsoft ran 10m SLOC through Mythos to get those 570 bugs, and a smaller project ran 1m SLOC and got 57 bugs, then you could reasonably argue that their code quality is about on a par with th