Microsoft patches 570 security flaws in record‑breaking July update

July 2026 saw Microsoft unleash a massive update:

Microsoft patches 570 security flaws – AI‑driven surge

In a historic move, Microsoft patches 570 security flaws across Windows and its ecosystem, a ↑ 570 jump that eclipses the previous record. Critical ratings apply to nearly 60 of the fixes, meaning attackers could gain remote control with minimal user interaction. The bulletin also closes three zero‑day bugs, two of which are already exploited in the wild. One zero‑day, CVE‑2026‑56155, elevates privileges in Active Directory Federation Services; another, CVE‑2026‑56164, targets SharePoint. A BitLocker bypass (CVE‑2026‑50661) could let a thief read encrypted data if they possess the device, though Microsoft sees no active exploits.

“The pace of vulnerability discovery is changing with advances in AI,” said Pavan Davuluri, Microsoft EVP, in a July 9 blog post.

Action1’s Jack Bicer highlighted a remote‑code execution flaw in Microsoft Copilot (CVE‑2026‑48561) with a CVSS score of ↓ 9.6, exploitable via a malicious website that tricks Edge for Android into sending crafted prompts. Security analysts warn that AI not only speeds discovery but also helps threat actors craft exploits faster, challenging Microsoft’s traditional exploitability index. Tenable’s Satnam Narang noted that AI models have already generated proof‑of‑concept exploits for vulnerabilities rated “less likely.” The patch frenzy mirrors a broader industry trend: Adobe, Cisco, Mozilla, Oracle and Google are all accelerating their update cycles, often citing AI as a catalyst. Reuters reports that Google alone delivered over 900 fixes in June. Users should back up data before installing, and consider a short delay to monitor early stability reports.

Analysis by Nova Stirling (Aerospace & Space Tech Correspondent).