Patch Tuesday Breaks a Record
The amount of software that needs fixing has changed, and it changed fast.
Start with Microsoft. Its October Patch Tuesday fixed a record 1,411 flaws, by BleepingComputer’s count. PCWorld notes that’s more than Microsoft fixed in any previous full year. Seventy were rated critical, and 57 of those allow remote code execution. One zero-day was already being exploited in attacks, and two more were public before a fix existed. That total is conservative. BleepingComputer counts only what Microsoft releases on Patch Tuesday itself, which leaves out another 348 flaws fixed earlier in the month. BleepingComputer ties the record to Microsoft’s continued use of AI to find and fix vulnerabilities in its own products.
Microsoft isn’t the only one shipping more. Epoch AI, a research group that tracks AI’s progress, counts vulnerability disclosures from 21 major software organizations, among them Microsoft, Google, Apple, Cisco, Red Hat and the Linux kernel. In July, those organizations published about 2,500 flaws rated high or critical. That’s roughly five times the biggest month on record before April, when Anthropic announced Claude Mythos Preview, a model it said could find and exploit vulnerabilities on its own. June had already set a record, at about 1,550. July beat it by 60 percent.
And those are only the flaws that have been disclosed. Anthropic says its Project Glasswing, which uses its models to find bugs in critical software, has turned up more than 10,000 serious vulnerabilities by itself.
Epoch is careful about cause. It says some of the increase is almost certainly AI making flaws easier to find, and some may simply be that more people are looking.
Either way, the count reaching the people who apply the fixes has moved. More serious flaws are being published than at any point in Epoch’s records, and the curve hadn’t flattened as of its latest count.
That’s how much is arriving. The harder question is how little of it tells you what to fix first.
Severity Stopped Sorting the Work
A severity score was never a measure of risk. It describes how bad a flaw could be if someone used it. It’s a storm’s category, not a forecast of where it makes landfall.
The score attached to every published vulnerability rates how the flaw is reached and what it compromises. It says nothing about whether anyone is exploiting it. CRACI, a company that sells vulnerability tracking, rebuilds the CVE Program’s own records every day, and it makes the point plainly: the score is not a measure of how much any particular organization is at risk. For years that gap was easy to live with, because serious flaws were rare enough to treat every one as urgent.
Discovery changed that, and severity came along with it. By that same count, the CVE Program published about 131 records a day in 2025. In 2026 it’s 280. Records rated high or critical went from 54 a day to 143. That’s about six serious flaws an hour, around the clock. AI made flaws cheaper to find. It didn’t make each one more likely to be used.
Exploitation is rising, but on a different curve. CISA’s Known Exploited Vulnerabilities catalog is the government’s list of flaws with reliable evidence of attacks in the wild. The Uptime Report’s analysis of that catalog counts 249 additions through October 2. That’s already more than all of 2025, and 32 percent ahead of the same point last year. It’s the busiest year since the catalog launched. It’s also about a third more exploitation, against more than twice the disclosures. And some of what lands on that list is years old.
Sort the queue by severity, and it grows with discovery. The risk grows with exploitation. Those curves have split.
CISA has already rebuilt its own rules around that split. Binding Operational Directive 26-04, issued in June, replaced the agency’s earlier patching directives and cited AI’s effect on the volume of vulnerabilities. It sorts federal remediation by four questions:
- Is the system exposed to the internet?
- Is the flaw on the exploited list?
- Can exploitation be automated at scale?
- Does it hand an attacker control of the system?
Deadlines run from three days to sixty. The fastest ones go to exploited flaws on exposed systems, and agencies can defer action on the lower-risk ones. CISA encourages every organization to take the same approach.
In plain terms, severity now measures how much was found. Exploitation and exposure measure what’s dangerous.
That split doesn’t stay inside federal agencies.
When the Queue Outgrows the Team
For an MSP, the split lands in the patch policy.
If your policy still promises to fix every critical within a set number of days, it was written for a world where critical meant rare. The number of things it now calls urgent is set by how fast flaws are found. How many you can actually fix is set by the hours your team has.
Look first at a company that had the hours to spend. Bank of America CEO Brian Moynihan said the bank brought in about 1,000 outside contractors in the second quarter to fix weaknesses that AI models had found, Anthropic’s Mythos among them. They work alongside roughly 3,000 of the bank’s own people already assigned to that job. The flaws were in code the bank runs, both its own and its vendors’. Moynihan put the quarter’s remediation costs at “a couple hundred million dollars plus.” That figure also covers separate anti-money-laundering fixes. He expects the cost to fall as the backlog clears. In plain terms, one of the largest banks in the country answered the volume with labor. AI scaled the finding. Nobody has scaled the fixing the same way.
Now look at the labor MSPs have. Nerdio, which sells management tools for Microsoft environments, surveyed 153 MSP decision-makers for its 2026 State of the MSP Business Report:
- 60% say management complexity is growing faster than their ability to scale.
- 29% grew their customer base without adding engineers in proportion.
- 29% lost technicians to workload-related burnout in the twelve months before the survey.
Put those together. The bank added a third more people to the work to keep up. MSPs aren’t adding people at that rate, and many are losing the ones they have. So a severity rule doesn’t fail loudly. The queue just grows longer than the team, and something waits anyway. The only question is whether anyone chose what.
So here’s the choice. Rewrite your patch priority around exploitation and exposure. Flaws on CISA’s exploited list, on systems facing the internet, that would hand an attacker control, move first and move fast. Accept that some unexploited criticals will wait, and decide which ones. Or keep the severity rule, and let a queue bigger than your team decide what waits, without anyone deciding.
And that decision isn’t yours alone to make.
Because every MSP tells its clients it patches, and none of them can honestly say it patches everything anymore. So tell yours before a breach does. Here’s what we fix within days: exploited flaws on anything facing the internet. Here’s what rides the normal schedule, and why. That conversation is also the separator. A client who helped draw the line doesn’t blame you for where it fell, and won’t believe the competitor who says there isn’t one.
What to Consider
- Re-sort the queue every time the exploited list changes, not once a month. CISA updates its Known Exploited Vulnerabilities catalog several times a week, and publishes it as a free feed. Match each addition against what your clients actually run, and pull those fixes ahead of the monthly cycle. Microsoft’s new risk cohorts can help group the rest. Microsoft itself says the groupings don’t, on their own, show which flaws are most dangerous.
- Know what each client exposes to the internet before you need to. Exposure is the first question in CISA’s directive, and you can’t answer it without a current inventory of what faces the internet at each client. If it takes your team more than a day to say which clients run the product named in that morning’s KEV entry, close that gap first.
- Write down what waits, and show it. For each client, keep the fast lane and the deferral list side by side, and review both whenever the exploited list changes. Bring that page to the business review. It turns “we patch” into a decision the client has seen and agreed to.
If this trend continues: If disclosures keep outrunning exploitation through 2027, “we patch everything” will stop being a promise MSPs make and become one clients’ insurers and auditors ask them to prove, and only the MSPs with an exploitation-first policy will be able to.