Microsoft patched 1,411 vulnerabilities in a month: AI finds flaws faster than humans can fix them

The debate over whether AI can write decent code is still going. Meanwhile, another AI is quietly finding errors in code that has already been written—and doing it faster than humans can fix them. In October 2026, Microsoft released its monthly security updates with 1,411 fixes. The corresponding totals were 1,130 for all of 2025 and 1,009 for 2024. A single month surpassed an entire year.

A new record every month

As recently as June, 206 patched vulnerabilities were considered a record. In July, Microsoft warned customers that each release would contain more patches, and the numbers kept climbing: about 600 in July, with different publications counting anywhere from 570 to 622; about 420 in August; 974 in September; and 1,411 in October. The previous annual record of 1,245 vulnerabilities had stood since 2020, but a single October release surpassed it. A Zero Day Initiative expert described the July release this way: “The bug apocalypse has finally arrived.”

Microsoft itself identified the main source of the flood: MDASH, an agentic vulnerability-discovery system that combines several models, including third-party ones. It works in two stages. First, a scanner checks critical Windows binaries while models from different families debate each finding. A separate pipeline then filters out the remaining false positives. Only the findings in which the system has the highest confidence reach engineers. The AI also proposes fixes and selects regression tests, while people assess the risks and make the decisions.

Why has this become possible now? Previously, the main tool was fuzzing: feeding a program millions of malformed inputs and seeing what makes it crash. A fuzzer does not understand the code and misses logical errors that are visible only to someone reading the source. A language model reads code almost like a human, only many times faster. In 2024, the Big Sleep AI agent found an exploitable SQLite bug. At the 2025 DARPA AI Cyber Challenge finals, systems found 54 of 63 hidden vulnerabilities and produced a fix in an average of 45 minutes, at a cost of about $152 per task.

PHP2Shell: flaws more than a decade old

The same technology also works on code written by others. On October 21, PHP issued emergency updates for two critical vulnerabilities in the interpreter itself, collectively named PHP2Shell. They allow an unauthenticated attacker to execute code on a web server with a single request, before the website’s code even starts running. The bugs date back to PHP 5.4, released in 2012. Two teams, Calif and Wiz, discovered them independently, and both used AI.

The coordinated disclosure did not go as planned: details leaked onto Hacker News, and an Amazon honeypot recorded an exploitation attempt four days before the public announcement. CISA added both vulnerabilities to its catalog of actively exploited flaws. According to Censys, more than 32 million PHP services running vulnerable versions still remained online even after that. The researchers themselves temper the excitement: Calif said the team used publicly available models, and knowledge of PHP’s history mattered more than the model itself. Here, AI served as a very fast assistant to an experienced researcher.

Cheap to find, expensive to fix

There is another side to the story. Someone still has to download, test, and deploy each of those 1,411 fixes. In a Socura survey, 22% of UK security leaders said they had taken sick leave or gone on vacation just to avoid Patch Tuesday, while 41% had worked overtime. Oracle has introduced monthly critical-patch releases, and VMware is betting on Express Patches.

The pressure is even greater in open source. The curl project shut down its vulnerability reward program because the team was drowning in reports, many of them generated by AI. Among seven reports submitted in one week, not one described a real vulnerability. Microsoft has a dedicated pipeline to filter out false findings; volunteer projects do not.

What to do in practice

First, if you are responsible for infrastructure, move to automated update deployment with tools such as Windows Autopatch, and agree in advance on a process for urgent out-of-band patches. Second, check which PHP versions are running in production—especially older ones—and update them. Third, do not expect record-breaking totals to set your priorities for you. The number of bugs found shows how effectively AI can search, not how many of those bugs pose a real danger to your particular environment.

The time between discovery and attack is shrinking because the same models also help turn a bug into a working exploit. The winners will be those who learn to update their systems as quickly as AI finds flaws. Everyone else will have to get used to Patch Tuesdays containing roughly 1,500 items.