On October 13, 2026, Microsoft’s Patch Tuesday landed a record 1,411 fixes, including an already-exploited Windows Shell zero-day and a cluster of CVSS 9.8 remote-code-execution flaws on network-facing Windows services. Here is the patch order that actually protects an estate, from the exposed surface inward.
On October 11, 2026, the ’hv-iommu-guest’ driver landed in the IOMMU subsystem’s -next branch for Linux 7.4, bringing in-kernel DMA protection and VFIO device assignment to Linux guests running on Hyper-V. Administrators of Hyper-V fleets can start planning the migration, with the stable kernel expected in late December.
Microsoft launched Decision-1 in Foundry, a decision model post-trained on Alibaba’s Qwen3.5-9B rather than any OpenAI model, priced at $0.042 per million input tokens. Validate its calibration on your own data before trusting it with sensitive decisions.
September 2026’s Patch Tuesday, the largest in Microsoft’s history, closes a wormable RCE in Windows DNS Server, the first SigRed-class flaw since 2020. Isolate and patch your exposed DNS, DHCP and multicast servers first.
Microsoft described CVE-2026-65660 as a CVSS 6.5 spoofing issue; researcher Dinh Ho Anh Khoa showed it is actually a code-injection flaw (CWE-94) enabling authenticated remote code execution, and CISA added it to the KEV catalog on September 25, 2026 after observed attacks. Apply the August 11 patch and audit your SharePoint 2016, 2019 and Subscription Edition servers.
Announced on January 26, 2026 and built on TSMC’s 3nm process, Microsoft’s Maia 200 accelerator is now rolling out across Azure datacenters with 30% better performance per dollar. It is Azure’s bet on homegrown silicon to break its dependence on NVIDIA and OpenAI.
Microsoft delivered 973 fixes on September 8, 2026 — the biggest Patch Tuesday in its history — including two elevation-of-privilege flaws already exploited in the wild. Deploy the two zero-days within 24 hours, then address the critical remote-code-execution flaws within seven days.
The September 8, 2026 Patch Tuesday breaks a record with 964 CVEs, including two zero-days already exploited in the wild, CVE-2026-81963 and CVE-2026-85880. Triage the bulletin by exploitability — zero-days first, then internet-facing RCEs — rather than by raw score.
A deserialization flaw in Entra ID, Microsoft’s cloud identity service, allowed unauthenticated remote code execution — rated CVSS 10.0 and fixed server-side with no customer action. CISOs need to understand what "no action required" actually demands of them.
The August 11, 2026 Patch Tuesday ships 421 fixes — a zero-day already exploited in the wild (CVE-2026-68820) by North Korea’s Lazarus group, plus two network flaws exploitable without authentication. Here is the patch order that actually protects your estate.
On July 14, 2026, Microsoft patched an AD CS flaw letting any authenticated user impersonate a domain controller. By July 27, the PoC was public — every unpatched domain is one script away from full compromise.
Microsoft shipped its largest-ever Patch Tuesday, 24 billion stolen credentials surfaced on an exposed Elasticsearch cluster, and ransomware gangs claimed 721 new victims. Three records, one month — and none of them are a coincidence.
