Microsoft yesterday released its November monthly security updates (Patch Tuesday), and according to BleepingComputer it is a record: 1,235 flaws fixed, not counting 108 additional flaws fixed earlier this month. Among them is a zero-day in Microsoft Outlook that attackers are already exploiting.
The record did not come out of nowhere. In October Microsoft fixed more than 1,400 flaws, and in September about 970. Just a year ago, a monthly update of a few dozen flaws was normal. Part of the explanation for the jump is AI tools that scan code and find flaws at a pace humans could not reach, both among researchers and defenders and at the companies themselves.
That sounds like good news, and to some extent it is: every fixed flaw is one an attacker will not exploit. But for IT teams it is a nightmare. An update covering more than a thousand flaws requires testing, prioritization and system restarts, and most organizations cannot test every fix in depth. The result is that many organizations install late, or without testing, and both are dangerous.
Other flaws are being exploited the same week: Ivanti fixed two Connect Secure flaws early this month that were chained in zero-day attacks since early October, Google fixed the eighth Chrome zero-day exploited this year, and attackers are exploiting a flaw in the Xen Orchestra virtualization management system. The time from disclosure to exploitation is shrinking, and the window to update in time is small.
What to do? Home users: make sure automatic Windows and Office updates are on, and restart the computer when asked. Organizations: prioritize the flaws already being exploited, starting with Outlook, and only then the rest. And anyone still managing updates once a quarter needs to understand that in a world where AI finds a thousand flaws a month, that pace is no longer enough.
