These are the latest security updates from Microsoft
Microsoft has released a major set of security updates, fixing more than 570 security vulnerabilities across Windows and other Microsoft products. This is almost three times more than the previous Patch Tuesday update, which had already set a record.
The company said the sharp increase in security fixes is mainly because artificial intelligence (AI) is helping researchers discover software vulnerabilities much faster than before.
Among the issues fixed this month, nearly 60 were rated as Critical. These are the most dangerous types of security flaws because attackers could use them to take control of a Windows computer remotely, often without requiring any action from the user.
Microsoft also fixed three zero-day vulnerabilities, which are security flaws that become known before a fix is available. Two of these vulnerabilities are already being actively exploited by hackers.
Zero-Day Vulnerabilities
Two of the zero-day flaws allow attackers to gain higher privileges on Windows systems, giving them greater control over affected devices. They include:
- CVE-2026-56155 – An Active Directory Federation Services vulnerability.
- CVE-2026-56164 – A Microsoft SharePoint vulnerability.
In total, Microsoft fixed around 250 privilege escalation vulnerabilities in this month’s updates.
Another important vulnerability, CVE-2026-50661, affects Windows BitLocker, Microsoft’s drive encryption feature. If an attacker has physical access to a computer, this flaw could allow them to bypass BitLocker protection and access encrypted files. Microsoft said the vulnerability has been publicly disclosed but is not currently being used in real-world attacks.
AI Is Finding More Security Bugs
In a blog post published on July 9, Microsoft Executive Vice President Pavan Davuluri explained that Windows users should expect larger security updates in the future because AI is making vulnerability discovery much faster.
According to Microsoft, AI can scan huge amounts of software code and identify weaknesses more quickly than traditional methods. This means security researchers can discover and fix more vulnerabilities before attackers exploit them.
A Serious Microsoft Copilot Vulnerability
Security researchers also highlighted CVE-2026-48561, a critical remote code execution vulnerability in Microsoft Copilot with a CVSS severity score of 9.6 out of 10.
The flaw could allow an attacker to run malicious code over a network without authorization. Microsoft said an attacker could exploit this vulnerability by creating a malicious website. If someone visits the site using Microsoft Edge on Android, specially crafted prompts could automatically be sent to Copilot, potentially allowing code execution.
AI Also Helps Attackers
While AI is helping software companies find and fix vulnerabilities faster, cybersecurity experts warn that it is also making life easier for attackers.
AI tools can quickly analyze newly published vulnerabilities and generate working exploits much faster than humans. This reduces the amount of time organizations have to install security updates before attackers begin abusing the flaws.
Microsoft uses an Exploitability Index to estimate how likely a vulnerability is to be exploited. However, some security experts believe this system needs to evolve because AI can now create exploits much faster than the traditional human-based predictions assume.
For example, Microsoft initially rated the SharePoint zero-day vulnerability as “Less Likely” to be exploited, but it was later added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) list of Known Exploited Vulnerabilities, showing that attackers were already using it.
Researchers at Anthropic also found that their AI security testing model successfully created proof-of-concept exploits for 13 out of 14 vulnerabilities that Microsoft had rated as unlikely to be exploited. This suggests AI is changing how quickly cybercriminals can develop attacks.
Security Updates Are Becoming More Frequent
Microsoft is not the only company increasing the number of security updates.
Other major software companies are also releasing patches more often, including:
- Adobe, which will now publish security updates twice every month.
- Cisco
- Mozilla
- Oracle
- Google, which released more than 900 security fixes during June 2026.
Many of these companies also say AI is helping them identify software vulnerabilities faster, leading to larger and more frequent security updates.
Overall, the growing use of AI is transforming cybersecurity. It allows software vendors to discover and fix vulnerabilities more quickly, but it also enables attackers to develop exploits faster. As a result, installing security updates promptly has become more important than ever.
