Microsoft patches 570 security flaws – AI‑driven July Patch Tuesday shatters record

Microsoft patches 570 security flaws in its July Patch Tuesday, a surge that dwarfs the record‑smashing batch released a month earlier, marking ↑ 570 fixes.

Microsoft patches 570 security flaws in unprecedented July release

Nearly 60 of those vulnerabilities carry a “critical” rating, meaning threat actors could seize remote control with minimal user interaction. The update also neutralizes three zero‑day exploits, two of which are already active in the wild. One privilege‑escalation bug (CVE‑2026‑56155) targets Active Directory Federation Services, while another (CVE‑2026‑56164) hits SharePoint. A BitLocker bypass (CVE‑2026‑50661) could expose encrypted data if an attacker obtains physical access, though Microsoft says no active exploitation is known. In a July 9 blog, Executive Vice President Pavan Davuluri warned that AI‑driven analysis is inflating the volume of patches, stating,

“The pace of vulnerability discovery is changing with advances in AI …”

Security researcher Jack Bicer highlighted a remote‑code execution flaw in Microsoft Copilot (CVE‑2026‑48561, CVSS 9.6) that could be triggered via a malicious web page on Edge for Android. Tenable’s Satnam Narang criticised Microsoft’s exploitability index as lagging behind AI‑generated proofs of concept, noting that Anthropic’s Red Team could craft exploits for 13 of 14 bugs rated “unlikely”. Industry peers are accelerating their own cadence: Adobe now issues bi‑monthly bulletins, Cisco, Mozilla, Oracle and Google are issuing more frequent updates (Reuters). Experts advise backing up data before installing the massive patch set; with ↓ 60 critical bugs, a short delay can help avoid early‑stage stability issues. The surge mirrors a broader trend where AI both uncovers and expedites exploitation of software weaknesses, a dynamic first seen during the recent pandemic response.