Day: October 16, 2026

September’s Patch Tuesday shipped a record 966 fixes, with roughly 438 of them elevation-of-privilege bugs, and AI-assisted discovery suggests volume will stay high. Here is a practical triage framework so your team patches the right things first instead of treating every CVE as equal.

September’s record Patch Tuesday included two actively exploited local privilege escalation zero-days: one in the Windows Update stack, one in ALPC. Neither gives remote access alone, which is exactly why they matter once an attacker is already on a box. Here is what they do and how to confirm your fleet is covered.