Your laptop asked to restart again. It has been doing that a lot this year, and there is a reason for it that has nothing to do with Microsoft tidying up.
On 13 October, Microsoft’s monthly security update fixed more than 1,400 bugs in Windows and its other software. That is a record, and it is not a one-off. The month before set the previous record at close to 1,000, and a normal month used to come in at about a tenth of that.
What changed is what is finding the bugs. Microsoft says its own AI tools are now reading its code and turning up problems faster than any team of people could, so more fixes get written each month, and more updates land on the machine in front of you. Here is what happened, and what it means for the next time Windows asks for ten minutes.
What happened
Microsoft ships its security fixes on the second Tuesday of every month, a date the industry calls Patch Tuesday. The release on 13 October 2026 was the biggest one yet. Krebs on Security, which reported the total, counted more than 1,400 vulnerabilities in it. A vulnerability is a flaw in software that lets someone do something they should not be able to do, whether that is reading files they have no business seeing, or running their own code on your computer.
The run of numbers through the year is what makes this more than a big month.
- June: 206 fixes, a record at the time.
- July: 570, another record.
- August: 419.
- September: 973, a record again.
- October: more than 1,400.
A typical month before this year ran to roughly 100 fixes, so September was already about ten times the old normal, and October came in at around fourteen times that. Add the months up and Microsoft has fixed more than 4,000 vulnerabilities in 2026 so far, with two months still to go, according to figures the security firm Tenable gave to Krebs on Security. The previous full-year record was 1,261, set in 2020.
At least 78 of the October fixes were for flaws rated critical, which means an attacker can use them with little or no help from you. One had already been used against real systems before Microsoft knew it existed, which is what the industry calls a zero-day. That one is a flaw in the Windows Shell, the part of the system that draws your desktop and handles your files, and it affects Windows 10 and 11 as well as some server versions.
The cause is not that Microsoft suddenly got worse at writing software. It is that AI got much better at reading it. Microsoft’s Windows blog set out the change in July, when Pavan Davuluri, the vice president who runs Windows, wrote that as AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release.
What it means for the apps and devices you use
The practical answer is boring, and it works. Let the updates install. A flaw that a researcher has just published is a flaw that criminals can also read about, and the gap between a fix being released and someone trying it out is often days. Sitting on a restart for a month is the one choice here that carries real risk.
It helps to know that most of these flaws will never touch you. Of the thousands Microsoft has fixed this year, only 26 have turned up in the known exploited vulnerabilities catalogue, which CISA, the US government’s cybersecurity agency, keeps. Tyler Reguly, a researcher at the security firm Fortra, made that point to Krebs on Security, and his advice to companies was to patch those 26 first. For the rest of us, installing the whole batch is the easy version of the same advice.
If you are still on Windows 10, the free security updates now run to October 2027, after Microsoft extended the deadline twice. That gives you time to plan a replacement rather than panic about one.
The same treadmill runs under everything else you own. Your phone gets a monthly security release, your browser updates itself quietly in the background, and the router in the hallway is a small computer with software that somebody has to maintain. If you run a small website, the plugins and themes on it are in exactly the same position, which is why those update notices are worth taking seriously too.
There is a fair reading of all this that is not alarming at all. Those 4,000 flaws existed before anyone found them. Finding and fixing them is the system working, even when it arrives as a restart prompt in the middle of your afternoon.
The detail, for anyone curious
Each fix carries a number, and you can look any of them up. The industry tracks flaws in a public list called Common Vulnerabilities and Exposures, so a bug gets an identifier like CVE-2026-96951, which is the zero-day Microsoft patched in October. Every one of them has a page on Microsoft’s security update guide that names the affected software and the severity.
The AI doing the finding is a Microsoft system called MDASH, which runs several AI models together across the company’s code to hunt for the kinds of mistakes that turn into these flaws. When Microsoft introduced it in May, MDASH had found four critical bugs in Windows that would let an attacker run their own code. It found them without help. Parts of Windows were written decades ago, and code that old has had far less scrutiny than anything written this year. You can think of it as a very patient reader who never gets bored, working through a very long book.
The strain lands on companies rather than households. Security teams usually test updates before rolling them out, because a bad fix can stop work just as effectively as an attack, and a month with 1,400 of them is a lot of testing. As iTnews reported in July, Microsoft has also changed how it lists the flaws, so there is more to install and less public detail about each one.
What to watch
Three things will show where this goes.
- Whether November and December hold the pace. Microsoft has already passed its old full-year record more than three times over, so the question is how far past 4,000 it lands.
- Whether the exploited list grows. The known-exploited catalogue is the one that separates a number from a real threat.
- What happens to Windows 10. Free updates end in October 2027, and a lot of working computers will be deciding what to do about that.
Final Words
A security update is a repair notice, and this year Microsoft has been handing out a lot of them. The reason is not that Windows fell apart overnight. It is that AI gave the people who hunt for flaws a much better light to work by, and that light is now sweeping across software written long before anyone imagined this kind of scrutiny. Install the updates, keep the machine current, and read the monthly restart for what it is. Something was found, and something was fixed.
