The largest Patch Tuesday ever: 974 CVEs by Microsoft's own count, two exploited zero-days in ALPC and the Windows Update Stack, 37 bugs at CVSS 9.8 or higher, 20 that ZDI calls wormable — and WMIC is gone.
One authentication failure has degraded Exchange Online, Teams, SharePoint, Purview, and Defender since 11:08 AM EDT — no fix and no ETA as of publication.
Microsoft's retirement of free nonprofit licenses became a mass data-loss event in 2026 — and the deletion machinery worked exactly as documented.
August's Patch Tuesday lands at 400 fixes — huge, but no new record. Lazarus exploited an afd.sys zero-day to plant a rootkit, LegacyHive gets its patch, and a wormable DNS Server flaw tops the 9.8s.
Microsoft's July Patch Tuesday ships 570 fixes by BleepingComputer's count, 621 by ZDI's — two exploited zero-days in AD FS and SharePoint included. June's all-time record lasted exactly one month, and Microsoft spent the preceding week explaining why: an AI discovery harness now feeds the pipeline, and volumes go up from here.
The first Microsoft 365 price increase since 2022 takes effect July 1 — but most businesses won't pay more until their next renewal, and an early one can lock in today's rate.
A researcher dropped a seventh Windows zero-day hours after Patch Tuesday: RoguePlanet spawns a SYSTEM shell on fully-patched Windows 10 and 11, with no CVE and no fix. The exploit is narrower than it sounds — but the disclosure war that produced it is the part worth watching.
The largest Patch Tuesday ever shipped: roughly 200 vulnerabilities, 33 Critical, three publicly disclosed zero-days, and a CVSS 9.8 in Nuance PowerScribe that radiology shops should not sit on. The Secure Boot certificate deadline is 17 days out — this is the last Patch Tuesday before it.
Cortechs.ai and Microsoft will route NeuroQuant and OnQ Prostate results straight into the PowerScribe One report. For radiologists, the real win is ARIA surveillance and prostate RSI findings that land in the report instead of being dictated off a second screen.
Microsoft's May Patch Tuesday addresses 120 vulnerabilities and contains no zero-days — the first such month since June 2024. Among the Critical fixes are three RCEs at CVSS 9.8 or higher: Netlogon, Windows DNS Client, and Microsoft Dynamics 365. The Secure Boot certificate deadline is 45 days out.