{"id":934715,"date":"2026-10-20T08:24:10","date_gmt":"2026-10-20T08:24:10","guid":{"rendered":"https:\/\/www.newsbeep.com\/au\/934715\/"},"modified":"2026-10-20T08:24:10","modified_gmt":"2026-10-20T08:24:10","slug":"is-microsofts-patch-tuesday-too-big-to-tackle-in-a-word-yes","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/au\/934715\/","title":{"rendered":"Is Microsoft\u2019s Patch Tuesday too big to tackle? In a word, yes"},"content":{"rendered":"

It was Microsoft\u2019s largest Patch Tuesday since it began in 2003, and a very different beast from those halcyon days.<\/p>\n

\n You\u2019re out of free articles for this month <\/p>\n

<\/p>\n

Prior to the monthly standard established then, Microsoft released patches and updates as needed, which made it difficult to plan around, particularly for busy IT departments.<\/p>\n

<\/p>\n

And, of course, it grew. Just seven years later, one Patch Tuesday featured a whopping 49 vulnerabilities, which was touted by media outlets at the time as the \u201cbiggest ever\u201d at the time, more than three times larger (shock! horror!) than the previous month.<\/p>\n

<\/p>\n

Fast forward to the most recent Patch Tuesday, and Microsoft dropped more than 1,400 patches \u2013 42 per cent more than the month prior, in September, and eight times larger than the same period a year before.<\/p>\n

<\/p>\n

And, according to NinjaOne\u2019s APAC director, MJ Robotham, we ain\u2019t seen nothin\u2019 yet.<\/p>\n

<\/p>\n

\u201cThis is quickly becoming the new normal, and I don\u2019t think we\u2019re anywhere near the peak yet,\u201d Robotham told Cyber Daily.<\/p>\n

<\/p>\n

\u201cPart of this is simply that there\u2019s more software in the world than ever, and much of it sits on decades-old code that\u2019s never been properly examined.\u201d<\/p>\n

<\/p>\n

The rising wave of vulnerabilities is so great that Microsoft\u2019s looking at a new way to handle patching, talking about \u201crisk cohorts\u201d to make the job of triaging what to address and when an easier one to navigate.<\/p>\n

<\/p>\n

\u201cEach CVE still needs to be reviewed on its own merits, but many CVEs require analysts to answer the same questions about deployment, exposure, trust boundaries, and usage patterns,\u201d Microsoft said in a recent blog post<\/a>.<\/p>\n

<\/p>\n

\u201cGrouping CVEs around those shared questions can provide a more efficient starting point for analysis.<\/p>\n

<\/p>\n

\u201cWe call these provisional groupings risk cohorts. They are an exploratory way to help customers organise their own analysis.\u201d<\/p>\n

<\/p>\n

They\u2019re not official, do not change the company\u2019s guidance, and do not replace CVEs. Rather, Microsoft calls them a \u201cstarting point, not a final decision\u201d.<\/p>\n

<\/p>\n

\u201cCustomers should continue to review each CVE for active exploitation, severity, attack vector, user interaction, and product-specific guidance,\u201d Microsoft said.<\/p>\n

<\/p>\n

The accelerant making every IT department\u2019s life that much harder is \u2013 perhaps unsurprisingly \u2013 artificial intelligence, Robotham said.<\/p>\n

<\/p>\n

\u201cVendors are now using AI to dig through that code and surface flaws at a pace that wasn\u2019t possible a year ago, and attackers are using AI to their advantage too,\u201d he said.<\/p>\n

<\/p>\n

\u201cOn one hand, this means vulnerabilities are being found and fixed before they can be exploited. But it puts vendors like Microsoft on a real shot clock, and it puts enormous pressure on the IT teams who have to act on every update.<\/p>\n

<\/p>\n

\u201cThe moment a patch is released, it\u2019s essentially open season. Attackers know exactly where to look, and any system left unpatched goes straight to the top of their list.\u201d<\/p>\n

<\/p>\n

Robotham believes that monthly patch releases are no longer fit for purpose, and that 1,000-plus vulnerabilities reported each month is \u201cbecoming the norm rather than the exception\u201d.<\/p>\n

<\/p>\n

“The real issue is the cost of delay. Once a fix is out, every day it sits unapplied is another day of exposure,\u201d he said.<\/p>\n

<\/p>\n

\u201cIt\u2019s near impossible for any team to work through more than a thousand fixes a month by hand. The organisations that come through this will be the ones using automation to work out which patches matter most to their environment, and getting them applied quickly and safely.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"It was Microsoft\u2019s largest Patch Tuesday since it began in 2003, and a very different beast from those…\n","protected":false},"author":2,"featured_media":934716,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[64,63,105],"class_list":["post-934715","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-au","tag-australia","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/934715","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=934715"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/934715\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/934716"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=934715"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=934715"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=934715"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}