Microsoft this week released fixes for a record number of security flaws in Windows and other software, KrebsOnSecurity and The Hacker News reported.

KrebsOnSecurity said the update fixed more than 1,400 flaws. The Hacker News put the number at 1,413. KrebsOnSecurity said the batch dwarfs September's record of nearly 1,000 fixes.

The number far surpasses the record year of 2020, when Microsoft patched 1,261 flaws, Satnam Narang of Tenable said, according to KrebsOnSecurity.

The Hacker News said 1,102 of the flaws were in Windows and 134 in Office. More than 70 are rated critical, it reported. KrebsOnSecurity said at least 78 are critical, meaning they could be used with little or no action by the user.

One flaw, CVE-2026-96951, is already being used by attackers, both outlets reported. It is in the Windows Shell and affects Windows 10 and 11, KrebsOnSecurity said. Microsoft said an attacker could use it to get around a warning system that flags files from the internet, The Hacker News reported. The attacker would have to convince a user to click a link or open a file.

The U.S. Cybersecurity and Infrastructure Security Agency has told federal agencies to install that fix by Oct. 16, The Hacker News said.

Microsoft credits AI language models for the high number of bugs found, KrebsOnSecurity reported. "Is AI to blame? Partly," Dustin Childs of the Zero Day Initiative told The Hacker News. He said AI is speeding up bug-hunting on both sides.

Experts warn that such big updates put extra strain on security teams, KrebsOnSecurity said. Tyler Reguly of Fortra said teams should focus first on flaws known to be used in attacks, it reported. Childs said teams that sort bugs by count instead of risk are "burning cycles on the wrong bugs."

What we know: Microsoft fixed a record number of flaws, including one in active use.
What we don't: Who is using the Windows flaw or whom they have targeted.