Microsoft Shatters Another Record, Patching 973 Vulnerabilities in September

Microsoft patched a record 973 vulnerabilities this September, beating their other records from earlier this year.

Two of the patched vulnerabilities are zero-days being actively exploited in the wild.

The majority of them were privilege escalation vulnerabilities, which allow an attacker to give themselves higher privileges on the system than they're supposed to have, and remote code execution (RCE) vulnerabilities, which allow an attacker to run their own code on your machine.

The high number of issues fixed can likely at least partially be attributed to their in-house AI system for finding security exploits, codenamed MDASH.

AI has become proficient at finding vulnerabilities in software, which has caused many developers to have to fix more vulnerabilities more quickly than ever before. Some exploits have been sitting dormant in code for over a decade in some cases; the Linux kernel has had to fix multiple of these bugs and will likely have to fix many more.

Defenders have jumped on AI as a tool for finding and fixing bugs before they're found by attackers. Mozilla has embraced using AI to find and fix as many issues as possible. They're optimistic that, despite the initial workload of fixing so many bugs, these tools will actually tip the balance in favor of defenders in the long run.

The deadline before attackers using these tools overwhelm defenders might be approaching, though. OpenAI released a call for collective action on the imminent threat of AI vulnerabilities, calling on AI companies, organizations, and governments to coordinate cybersecurity efforts.

The letter was signed by a lot of organizations, including big tech companies like Google and IBM to even smaller companies like 1Password.

Supposedly, the cascade of issues will slow down once these frontier models find all the low-hanging fruit in the code. So far, though, they only seem to find more and more issues to fix.

The whack-a-mole strategy of fixing individual vulnerabilities as they pop up is being strained. Likely a better long-term solution is to categorically remove certain types of vulnerabilities, such as using memory-safe languages to prevent memory safety issues.

We can take some comfort in the fact that almost all of the 973 bugs were not known to be actively exploited, and now won't be as long you update your system.