Loading story…
Microsoft said Windows customers should expect more frequent security updates as the company expands AI-driven vulnerability discovery across its codebase. The effort centers on MDASH, a proprietary multi-model scanning system used by Microsoft's Autonomous Code Security team to scan critical Windows components, validate findings with multiple AI models, and reduce false positives through a Windows-specific validation pipeline. Microsoft said AI is also being used to analyze failures, suggest fixes, and locate similar flaws elsewhere in source code, while human engineers remain responsible for reviewing code changes and approving remediations.
The company said MDASH has already contributed to the disclosure of 16 previously unknown Windows vulnerabilities, including four Critical remote code execution flaws affecting the TCP/IP kernel stack, IKEv2, Netlogon, and the DNS API library, all patched in a May 2026 security release. Microsoft also tied the initiative to updates in its Secure Development Lifecycle to address AI-enabled attack techniques and introduce AI earlier in development, while reports noted that June 2026 Patch Tuesday fixed more than 200 vulnerabilities, underscoring how AI-assisted discovery is beginning to affect Microsoft's patching cadence and enterprise update workloads.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Ahead of the July 14 Patch Tuesday rollout, Microsoft warned that Windows quality updates should generally not be deferred for more than three days because AI is accelerating vulnerability analysis and exploit creation. Microsoft said attackers can use AI to turn publicly documented flaws into working exploits within hours and recommended deadlines of zero or one day with a grace period of no more than two days.
A June 2026 Patch Tuesday release fixed more than 200 vulnerabilities, which Microsoft-linked reporting cited as evidence that AI-assisted vulnerability discovery is already increasing the company’s patching cadence.
Microsoft said its MDASH AI scanning system identified 16 previously unknown Windows vulnerabilities, including four critical flaws, and that all were patched in a May 2026 security update/Patch Tuesday release.
Microsoft announced updates to its Secure Development Lifecycle to introduce AI earlier in development and address AI-enabled attack techniques and attack paths.
Microsoft said it is expanding use of its MDASH system and related AI-assisted remediation and validation workflows across Windows engineering, while keeping human engineers responsible for reviewing and validating fixes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcewindowslatest.com
Open sourcetheregister.com
Open sourcecybersecuritynews.com
Open sourceblogs.windows.com
Open sourcebleepingcomputer.com
Open sourcezdnet.com
Open sourceblogs.windows.com
Open sourceblogs.oracle.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released fixes for **137 vulnerabilities** across Windows, Azure, Microsoft 365, developer tools, and AI-related products, with no zero-days reported as exploited in the wild. The most urgent issues included a **wormable pre-auth remote code execution** flaw in **Windows Netlogon** (`CVE-2026-41089`), an **unauthenticated RCE** in the **Windows DNS Client** (`CVE-2026-41096`) that can be triggered through crafted DNS responses, and a **remote code execution** bug in **Microsoft Dynamics 365 on-premises** (`CVE-2026-42898`). Microsoft also patched an authenticated **SharePoint Server RCE** (`CVE-2026-40365`), multiple Microsoft Word Preview Pane RCEs, and a critical authentication bypass in the Microsoft SSO Plugin for Jira & Confluence (`CVE-2026-41103`). The release was notable for its severity, with reports citing **16 to 30 critical vulnerabilities** depending on classification, and **14 flaws scoring 9.0 or higher**, including an **Azure DevOps information disclosure** issue rated `CVSS 10.0` that Microsoft said had already been fully mitigated. Elevation-of-privilege bugs made up the largest share of fixes, spanning the Windows kernel, Win32k, TCP/IP, SMB Client, Print Spooler, and other core components; two locally exploitable issues, including **Windows Print Spooler** (`CVE-2026-34342`) and **Windows Message Queueing** (`CVE-2026-33838`), were publicly disclosed alongside patches. Microsoft said its AI-driven bug-finding system **MDASH** identified 16 of the vulnerabilities, and it separately warned enterprises to complete **Secure Boot certificate** updates before June 26, 2026, while noting a BitLocker Recovery issue on some Windows Server 2025 systems with an unrecommended Group Policy setting.
Jun 29, 2026
Microsoft released security updates for 90 vulnerabilities across its product portfolio, including 24 remote code execution flaws and nine rated **critical**. The August patch bundle addressed severe issues in Microsoft Dynamics 365, Microsoft Copilot Studio, Azure Health Bot, Windows TCP/IP, Windows Reliable Multicast Transport Driver, Windows Network Virtualization, and Linux boot components **`grub2`** and **`shim`**. Microsoft and CSIRT.SK said six vulnerabilities were already being exploited in the wild: **`CVE-2024-38189`**, **`CVE-2024-38178`**, **`CVE-2024-38193`**, **`CVE-2024-38106`**, **`CVE-2024-38107`**, and **`CVE-2024-38213`**. Among the most serious patched bugs were **`CVE-2024-38063`**, which allows unauthenticated remote code execution in Windows TCP/IP via crafted IPv6 packets, and **`CVE-2024-38140`**, which enables unauthenticated remote code execution in the Windows Reliable Multicast Transport Driver when PGM is enabled; defenders were urged to deploy the updates immediately.
Jul 24, 2026
Akamai researchers have developed an AI-driven tool, PatchDiff-AI, designed to automate the root cause analysis of vulnerabilities patched during Microsoft's regular Patch Tuesday updates. This system leverages large language models in a multi-agent configuration to rapidly analyze patched binaries, identify the underlying security flaws, and generate detailed reports, including attack vector analysis and exploitability. The tool demonstrated over 80% success in fully automated report generation, significantly accelerating the defensive response to newly disclosed vulnerabilities. A recent case study applied PatchDiff-AI to CVE-2025-60719, a use-after-free vulnerability in the Windows Ancillary Function Driver (afd.sys) for Winsock, which affects nearly all supported Windows versions. The flaw allows local privilege escalation by enabling a low-privilege attacker to manipulate kernel memory and gain system privileges. Microsoft addressed the issue by introducing a synchronization barrier to prevent unsafe unbinding of socket endpoints during critical operations. The research and tool were presented at Black Hat Europe Arsenal, highlighting the growing role of AI in vulnerability analysis and mitigation.
Jun 29, 2026